PT-2026-125109
CVE-2026-57193
·
Published
2026-10-26
·
Updated
2026-10-26
Description by
CVSS 4.0
6.9
MediumMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Asterisk versions prior to 20.20.1
Asterisk versions prior to 21.12.3
Asterisk versions prior to 22.10.1
Asterisk versions prior to 23.4.1
Certified Asterisk versions prior to 20.7-cert11
Certified Asterisk versions prior to 22.8-cert3
Description
The LDAP realtime driver
res config ldap allows LDAP filter injection via the SIP username. This enables an unauthenticated attacker to execute arbitrary LDAP queries and disclose information by sending specially crafted SIP packets. This issue occurs only when the res config ldap module is loaded and configured to access an LDAP server.Recommendations
Update to version 20.20.1
Update to version 21.12.3
Update to version 22.10.1
Update to version 23.4.1
Update Certified Asterisk to version 20.7-cert11
Update Certified Asterisk to version 22.8-cert3
As a temporary mitigation, avoid loading or disable the
res config ldap module if LDAP server access is not required. Found an issue in the description? Have something to add? Feel free to write us 👾