Read the docs
TI-2026-19114 Aliases CVE-2026-23741

Uncontrolled search path in asterisk

Priority LOW 37CWE-427Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-427.

Summary

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the asterisk/contrib/scripts/ast_coredumper runs as root, as noted by the NOTES tag on line 689 of the ast_coredumper file. The script will source the contents of /etc/asterisk/ast_debug_tools.conf, which resides in a folder that is writeable by the asterisk user:group. Due to the /etc/asterisk/ast_debug_tools.conf file following bash semantics and it being loaded; an attacker with write permissions may add or modify the file such that when the root ast_coredumper is run; it would source and thereby execute arbitrary bash code found in the /etc/asterisk/ast_debug_tools.conf. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00211 11th percentileScored 2026-11-07
Fix Fixed asterisk (asterisk): 23.2.2, 22.8.2, 21.12.1 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
asteriskasteriskbefore 23.2.2; before 22.8.2; before 21.12.1; before 20.18.2; before 20.7-cert923.2.2, 22.8.2, 21.12.1, 20.18.2, 20.7-cert9Patch availableCNA
  • asterisk Vendorasterisk Affected before 23.2.2; before 22.8.2; before 21.12.1; before 20.18.2; before 20.7-cert9 Fixed in 23.2.2, 22.8.2, 21.12.1, 20.18.2, 20.7-cert9 Patch available CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*before 20.18.2; 21.0.0 to before 21.12.1; 22.0.0 to before 22.8.2; 23.0.0 to before 23.2.2VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:*:*:*:*:*:*:*:*up to 18.9VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1:*:*:*:*:*:*20.7 cert1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc1:*:*:*:*:*:*20.7 cert1-rc1VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc2:*:*:*:*:*:*20.7 cert1-rc2VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert2:*:*:*:*:*:*20.7 cert2VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert3:*:*:*:*:*:*20.7 cert3VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert4:*:*:*:*:*:*20.7 cert4VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert5:*:*:*:*:*:*20.7 cert5VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert6:*:*:*:*:*:*20.7 cert6VulnerableSangoma
  • cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:* Versions before 20.18.2; 21.0.0 to before 21.12.1; 22.0.0 to before 22.8.2; 23.0.0 to before 23.2.2 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:*:*:*:*:*:*:*:* Versions up to 18.9 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1:*:*:*:*:*:* Versions 20.7 cert1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc1:*:*:*:*:*:* Versions 20.7 cert1-rc1 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc2:*:*:*:*:*:* Versions 20.7 cert1-rc2 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert2:*:*:*:*:*:* Versions 20.7 cert2 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert3:*:*:*:*:*:* Versions 20.7 cert3 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert4:*:*:*:*:*:* Versions 20.7 cert4 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert5:*:*:*:*:*:* Versions 20.7 cert5 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert6:*:*:*:*:*:* Versions 20.7 cert6 Vulnerable ·Sangoma
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert7:*:*:*:*:*:*20.7 cert7VulnerableSangoma
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert8:*:*:*:*:*:*20.7 cert8VulnerableSangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert7:*:*:*:*:*:* Versions 20.7 cert7 Vulnerable ·Sangoma
  • cpe:2.3:a:sangoma:certified_asterisk:20.7:cert8:*:*:*:*:*:* Versions 20.7 cert8 Vulnerable ·Sangoma

Remediation

  • Fix · CNA asterisk (asterisk) Fixed in 23.2.2, 22.8.2, 21.12.1, 20.18.2, 20.7-cert9

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-23741

References

Advisory 1

  • TI-2025-30244 Using malformed From header can forge identity with ";" or NULL in name portion CVSS 3.1HIGH 7.7
  • TI-2023-27195 Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation CVSS 3.1HIGH 7.5
  • TI-2024-28351 Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan CVSS 3.1HIGH 8.8
  • TI-2025-00959 Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation CVSS 4.0HIGH 7.0
  • TI-2025-34699 Asterisk remotely exploitable leak of RTP UDP ports and internal resources CVSS 3.1MEDIUM 6.5
  • TI-2025-31747 Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation CVSS 3.1MEDIUM 6.5
See all 87 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences