Read the docs
TI-2024-28351 Aliases CVE-2024-42365

Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan

Priority HIGH 71CWE-1220Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Asterisk is an open source private branch exchange (PBX) and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2, an AMI user with `write=originate` may change all configuration files in the `/etc/asterisk/` directory. This occurs because they are able to curl remote files and write them to disk, but are also able to append to existing files using the `FILE` function inside the `SET` application. This issue may result in privilege escalation, remote code execution and/or blind server-side request forgery with arbitrary protocol. Asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2 contain a fix for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.04703 91st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed asterisk (asterisk): 18.24.2, 20.9.2, 21.4.2 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
asteriskasteriskbefore 18.24.2; 19.0.0 to before 20.9.2; 21.0.0 to before 21.4.2; before 18.9-cert11; 19.0 to before 20.7-cert218.24.2, 20.9.2, 21.4.2, 18.9-cert11, 20.7-cert2Patch availableCNA
  • asterisk Vendorasterisk Affected before 18.24.2; 19.0.0 to before 20.9.2; 21.0.0 to before 21.4.2; before 18.9-cert11; 19.0 to before 20.7-cert2 Fixed in 18.24.2, 20.9.2, 21.4.2, 18.9-cert11, 20.7-cert2 Patch available CNA

CPE configurations NVD · 55

CPEVersionsRoleVendor
cpe:2.3:a:asterisk:asterisk:*:*:*:*:*:*:*:*before 18.24.2; 19.0.0 to before 20.9.1Vulnerableasterisk
cpe:2.3:a:asterisk:asterisk:21.4.0:*:*:*:*:*:*:*21.4.0Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:13.13.0:*:*:*:*:*:*:*13.13.0Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:13.13.0:cert1:*:*:*:*:*:*13.13.0 cert1Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:13.13.0:cert1-rc1:*:*:*:*:*:*13.13.0 cert1-rc1Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:13.13.0:cert1-rc2:*:*:*:*:*:*13.13.0 cert1-rc2Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:13.13.0:cert1-rc3:*:*:*:*:*:*13.13.0 cert1-rc3Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:13.13.0:cert1-rc4:*:*:*:*:*:*13.13.0 cert1-rc4Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:13.13.0:cert2:*:*:*:*:*:*13.13.0 cert2Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:13.13.0:cert3:*:*:*:*:*:*13.13.0 cert3Vulnerableasterisk
  • cpe:2.3:a:asterisk:asterisk:*:*:*:*:*:*:*:* Versions before 18.24.2; 19.0.0 to before 20.9.1 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:asterisk:21.4.0:*:*:*:*:*:*:* Versions 21.4.0 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:13.13.0:*:*:*:*:*:*:* Versions 13.13.0 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:13.13.0:cert1:*:*:*:*:*:* Versions 13.13.0 cert1 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:13.13.0:cert1-rc1:*:*:*:*:*:* Versions 13.13.0 cert1-rc1 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:13.13.0:cert1-rc2:*:*:*:*:*:* Versions 13.13.0 cert1-rc2 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:13.13.0:cert1-rc3:*:*:*:*:*:* Versions 13.13.0 cert1-rc3 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:13.13.0:cert1-rc4:*:*:*:*:*:* Versions 13.13.0 cert1-rc4 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:13.13.0:cert2:*:*:*:*:*:* Versions 13.13.0 cert2 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:13.13.0:cert3:*:*:*:*:*:* Versions 13.13.0 cert3 Vulnerable ·asterisk
Show 45 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:asterisk:certified_asterisk:13.13.0:rc1:*:*:*:*:*:*13.13.0 rc1Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:13.13.0:rc2:*:*:*:*:*:*13.13.0 rc2Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8:cert1-rc1:*:*:*:*:*:*16.8 cert1-rc1Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8:cert1-rc2:*:*:*:*:*:*16.8 cert1-rc2Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8:cert1-rc3:*:*:*:*:*:*16.8 cert1-rc3Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8:cert1-rc4:*:*:*:*:*:*16.8 cert1-rc4Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8:cert1-rc5:*:*:*:*:*:*16.8 cert1-rc5Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8:cert10:*:*:*:*:*:*16.8 cert10Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8:cert11:*:*:*:*:*:*16.8 cert11Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8:cert12:*:*:*:*:*:*16.8 cert12Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8:cert13:*:*:*:*:*:*16.8 cert13Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8:cert14:*:*:*:*:*:*16.8 cert14Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8:cert4-rc1:*:*:*:*:*:*16.8 cert4-rc1Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8:cert4-rc2:*:*:*:*:*:*16.8 cert4-rc2Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8:cert4-rc3:*:*:*:*:*:*16.8 cert4-rc3Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8:cert4-rc4:*:*:*:*:*:*16.8 cert4-rc4Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:-:*:*:*:*:*:*16.8.0Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert1:*:*:*:*:*:*16.8.0 cert1Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert10:*:*:*:*:*:*16.8.0 cert10Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert11:*:*:*:*:*:*16.8.0 cert11Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert12:*:*:*:*:*:*16.8.0 cert12Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert2:*:*:*:*:*:*16.8.0 cert2Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert3:*:*:*:*:*:*16.8.0 cert3Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert4:*:*:*:*:*:*16.8.0 cert4Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert5:*:*:*:*:*:*16.8.0 cert5Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert6:*:*:*:*:*:*16.8.0 cert6Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert7:*:*:*:*:*:*16.8.0 cert7Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert8:*:*:*:*:*:*16.8.0 cert8Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert9:*:*:*:*:*:*16.8.0 cert9Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:18.9:cert1:*:*:*:*:*:*18.9 cert1Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:18.9:cert1-rc1:*:*:*:*:*:*18.9 cert1-rc1Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:18.9:cert10:*:*:*:*:*:*18.9 cert10Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:18.9:cert2:*:*:*:*:*:*18.9 cert2Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:18.9:cert3:*:*:*:*:*:*18.9 cert3Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:18.9:cert4:*:*:*:*:*:*18.9 cert4Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:18.9:cert5:*:*:*:*:*:*18.9 cert5Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:18.9:cert6:*:*:*:*:*:*18.9 cert6Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:18.9:cert7:*:*:*:*:*:*18.9 cert7Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:18.9:cert8:*:*:*:*:*:*18.9 cert8Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:18.9:cert8-rc1:*:*:*:*:*:*18.9 cert8-rc1Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:18.9:cert8-rc2:*:*:*:*:*:*18.9 cert8-rc2Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:18.9:cert9:*:*:*:*:*:*18.9 cert9Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:20.7:cert1:*:*:*:*:*:*20.7 cert1Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:20.7:cert1-rc1:*:*:*:*:*:*20.7 cert1-rc1Vulnerableasterisk
cpe:2.3:a:asterisk:certified_asterisk:20.7:cert1-rc2:*:*:*:*:*:*20.7 cert1-rc2Vulnerableasterisk
  • cpe:2.3:a:asterisk:certified_asterisk:13.13.0:rc1:*:*:*:*:*:* Versions 13.13.0 rc1 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:13.13.0:rc2:*:*:*:*:*:* Versions 13.13.0 rc2 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8:cert1-rc1:*:*:*:*:*:* Versions 16.8 cert1-rc1 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8:cert1-rc2:*:*:*:*:*:* Versions 16.8 cert1-rc2 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8:cert1-rc3:*:*:*:*:*:* Versions 16.8 cert1-rc3 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8:cert1-rc4:*:*:*:*:*:* Versions 16.8 cert1-rc4 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8:cert1-rc5:*:*:*:*:*:* Versions 16.8 cert1-rc5 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8:cert10:*:*:*:*:*:* Versions 16.8 cert10 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8:cert11:*:*:*:*:*:* Versions 16.8 cert11 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8:cert12:*:*:*:*:*:* Versions 16.8 cert12 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8:cert13:*:*:*:*:*:* Versions 16.8 cert13 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8:cert14:*:*:*:*:*:* Versions 16.8 cert14 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8:cert4-rc1:*:*:*:*:*:* Versions 16.8 cert4-rc1 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8:cert4-rc2:*:*:*:*:*:* Versions 16.8 cert4-rc2 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8:cert4-rc3:*:*:*:*:*:* Versions 16.8 cert4-rc3 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8:cert4-rc4:*:*:*:*:*:* Versions 16.8 cert4-rc4 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8.0:-:*:*:*:*:*:* Versions 16.8.0 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert1:*:*:*:*:*:* Versions 16.8.0 cert1 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert10:*:*:*:*:*:* Versions 16.8.0 cert10 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert11:*:*:*:*:*:* Versions 16.8.0 cert11 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert12:*:*:*:*:*:* Versions 16.8.0 cert12 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert2:*:*:*:*:*:* Versions 16.8.0 cert2 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert3:*:*:*:*:*:* Versions 16.8.0 cert3 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert4:*:*:*:*:*:* Versions 16.8.0 cert4 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert5:*:*:*:*:*:* Versions 16.8.0 cert5 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert6:*:*:*:*:*:* Versions 16.8.0 cert6 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert7:*:*:*:*:*:* Versions 16.8.0 cert7 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert8:*:*:*:*:*:* Versions 16.8.0 cert8 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:16.8.0:cert9:*:*:*:*:*:* Versions 16.8.0 cert9 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:18.9:cert1:*:*:*:*:*:* Versions 18.9 cert1 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:18.9:cert1-rc1:*:*:*:*:*:* Versions 18.9 cert1-rc1 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:18.9:cert10:*:*:*:*:*:* Versions 18.9 cert10 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:18.9:cert2:*:*:*:*:*:* Versions 18.9 cert2 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:18.9:cert3:*:*:*:*:*:* Versions 18.9 cert3 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:18.9:cert4:*:*:*:*:*:* Versions 18.9 cert4 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:18.9:cert5:*:*:*:*:*:* Versions 18.9 cert5 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:18.9:cert6:*:*:*:*:*:* Versions 18.9 cert6 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:18.9:cert7:*:*:*:*:*:* Versions 18.9 cert7 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:18.9:cert8:*:*:*:*:*:* Versions 18.9 cert8 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:18.9:cert8-rc1:*:*:*:*:*:* Versions 18.9 cert8-rc1 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:18.9:cert8-rc2:*:*:*:*:*:* Versions 18.9 cert8-rc2 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:18.9:cert9:*:*:*:*:*:* Versions 18.9 cert9 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:20.7:cert1:*:*:*:*:*:* Versions 20.7 cert1 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:20.7:cert1-rc1:*:*:*:*:*:* Versions 20.7 cert1-rc1 Vulnerable ·asterisk
  • cpe:2.3:a:asterisk:certified_asterisk:20.7:cert1-rc2:*:*:*:*:*:* Versions 20.7 cert1-rc2 Vulnerable ·asterisk

Remediation

  • Fix · CNA asterisk (asterisk) Fixed in 18.24.2, 20.9.2, 21.4.2, 18.9-cert11, 20.7-cert2

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-42365

References

Exploit 1

Patch 5

Other 2

  • TI-2008-03125 The IAX2 protocol implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and… CVSS 2.0HIGH 7.8
  • TI-2007-02211 Multiple stack-based buffer overflows in the process_sdp function in chan_sip.c of the… CVSS 2.0HIGH 7.6
  • TI-2007-02404 The IAX2 channel driver (chan_iax2) in Asterisk before 20070504 does not properly null… CVSS 2.0HIGH 10.0
  • TI-2007-01503 The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote… CVSS 2.0HIGH 7.8
  • TI-2007-03651 Stack-based buffer overflow in the IAX2 channel driver (chan_iax2) in Asterisk before… CVSS 2.0HIGH 9.3
  • TI-2008-01337 The AsteriskGUI HTTP server in Asterisk Open Source 1.4.x before 1.4.19-rc3 and 1.6.x… CVSS 2.0HIGH 9.3
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences