CVE-2026-57200

Name of the Vulnerable Software and Affected Versions Asterisk versions prior to 20.20.1 Asterisk versions prior to 21.12.3 Asterisk versions prior to 22.10.1 Asterisk versions prior to 23.4.1 Certified Asterisk versions prior to 22.8-cert3

Description An authenticated attacker with read-only permissions for the Asterisk REST Interface (ARI) can execute write operations through REST-over-WebSocket. This authorization bypass allows for arbitrary module path loading and conditional remote code execution. The issue requires the Asterisk HTTP web server to be enabled and reachable, and the attacker must possess valid read-only ARI credentials.

Recommendations Update to version 20.20.1 Update to version 21.12.3 Update to version 22.10.1 Update to version 23.4.1 Update Certified Asterisk to version 22.8-cert3