Read the docs
TI-2026-80568 Aliases CVE-2026-57193

LDAP filter injection in Asterisk res_config_ldap via SIP username

Priority MEDIUM 40CWE-943Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Asterisk before 20.20.1, from 21.0.0-pre1 before 21.12.3, from 22.0.0-pre1 before 22.10.1 and from 23.0.0-pre1 before 23.4.1 are affected, as are Certified Asterisk before 20.7-cert11 and from 22.8-cert1-pre1 before 22.8-cert3. The res_config_ldap LDAP realtime driver does not neutralize special elements in LDAP filters (CWE-943), so a SIP username can inject filter syntax. An unauthenticated remote attacker can send crafted SIP packets to make arbitrary LDAP queries and disclose information, but only if the module is loaded and configured to access an LDAP server, which is not the default.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver `res_config_ldap` may permit `LDAP filter injection` through a `SIP username`, allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The `res_config_ldap` module must be loaded and configured to access an LDAP server, which is not the default. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01963 80th percentileScored 2026-11-07
Fix Fixed asterisk (asterisk): 20.20.1, 21.12.3, 22.10.1 +1certified-asterisk (asterisk): 20.7-cert11, 22.8-cert3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
asteriskasteriskbefore 20.20.1; 21.0.0-pre1 to before 21.12.3; 22.0.0-pre1 to before 22.10.1; 23.0.0-pre1 to before 23.4.120.20.1, 21.12.3, 22.10.1, 23.4.1Patch availableCNA
asteriskcertified-asteriskbefore 20.7-cert11; 22.8-cert1-pre1 to before 22.8-cert320.7-cert11, 22.8-cert3Patch availableCNA
  • asterisk Vendorasterisk Affected before 20.20.1; 21.0.0-pre1 to before 21.12.3; 22.0.0-pre1 to before 22.10.1; 23.0.0-pre1 to before 23.4.1 Fixed in 20.20.1, 21.12.3, 22.10.1, 23.4.1 Patch available CNA
  • certified-asterisk Vendorasterisk Affected before 20.7-cert11; 22.8-cert1-pre1 to before 22.8-cert3 Fixed in 20.7-cert11, 22.8-cert3 Patch available CNA

Remediation

Upgrade Asterisk to 20.20.1, 21.12.3, 22.10.1 or 23.4.1, and upgrade Certified Asterisk to 20.7-cert11 or 22.8-cert3.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA asterisk (asterisk) Fixed in 20.20.1, 21.12.3, 22.10.1, 23.4.1
  • Fix · CNA certified-asterisk (asterisk) Fixed in 20.7-cert11, 22.8-cert3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Fuse 7

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-57193
  2. 2026-10-27 Priority changed: MEDIUM → LOW
  3. 2026-10-31 CISA SSVC decision points changed
  4. 2026-10-31 Priority changed: LOW → MEDIUM
  5. 2026-11-02 Affected versions changed · Red Hat
  6. 2026-11-02 CVSS score added · Red Hat

References

Other 15

  • TI-2025-30244 Using malformed From header can forge identity with ";" or NULL in name portion CVSS 3.1HIGH 7.7
  • TI-2023-27195 Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation CVSS 3.1HIGH 7.5
  • TI-2024-28351 Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan CVSS 3.1HIGH 8.8
  • TI-2025-00959 Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation CVSS 4.0HIGH 7.0
  • TI-2025-34699 Asterisk remotely exploitable leak of RTP UDP ports and internal resources CVSS 3.1MEDIUM 6.5
  • TI-2025-31747 Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation CVSS 3.1MEDIUM 6.5
See all 87 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences