# CVE-2026-57202: Asterisk privilege escalation in REST Interface

Source: https://junglewise.ai/threats/cve-2026-57202-asterisk-is-an-open-source-private-branch-exchange-and-telephony  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-57202 · Severity: high · CVSS 8.1 · Published 2026-10-27

Asterisk is a telephony toolkit that manages business phone systems and calls. A read-only user of Asterisk's REST API could bypass security controls to execute dangerous operations like writing files to the system, even when the administrator has disabled such operations via the `live_dangerously` setting. This requires the attacker to already possess read-only API credentials and the HTTP server to be enabled.

Technologies: [Asterisk](https://junglewise.ai/threats/technologies/asterisk), [Asterisk Certified Asterisk](https://junglewise.ai/threats/technologies/certified-asterisk). Vendors: [Asterisk](https://junglewise.ai/threats/vendors/asterisk).

## Quick answers

**Is CVE-2026-57202 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57202 being exploited in the wild.

**How severe is CVE-2026-57202?** High severity, with a CVSS score of 8.1, published 27 October 2026.

**Which products and versions are affected?** Asterisk before 20.20.1, 21.x before 21.12.3, 22.x before 22.10.1, 23.x before 23.4.1; Asterisk Certified Asterisk 20.7.x before 20.7-cert11, 22.8.x before 22.8-cert3.

**Is there a fix for CVE-2026-57202?** Yes: fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1; Certified Asterisk 20.7-cert11, 22.8-cert3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57202 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-57202?** Check whether you run Asterisk or Asterisk Certified Asterisk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1; Certified Asterisk 20.7-cert11, 22.8-cert3

## Technical details

An authenticated attacker with read-only ARI credentials can invoke the `setChannelVar` function to execute dangerous dialplan functions (FILE(), DB(), SHELL(), CURL(), STAT()) via the Asterisk REST Interface, bypassing the `live_dangerously=no` security control in asterisk.conf. The vulnerability requires the HTTP web server to be enabled and reachable; HTTP is disabled by default and only binds to 127.0.0.1 when enabled. The fix implements an `inhibit_escalations` flag during variable setting to prevent dangerous dialplan function execution from ARI.

## Affected products

- Asterisk Asterisk before 20.20.1, 21.x before 21.12.3, 22.x before 22.10.1, 23.x before 23.4.1
- Asterisk Certified Asterisk 20.7.x before 20.7-cert11, 22.8.x before 22.8-cert3

## Timeline

- 2026-10-27: disclosed

## References

- [https://github.com/asterisk/asterisk/commit/8f8ccaf70a80e518147b0c35c0c252de4735446f](https://github.com/asterisk/asterisk/commit/8f8ccaf70a80e518147b0c35c0c252de4735446f)
- [https://github.com/asterisk/asterisk/commit/92a5dd1003b737ae1cd2df4e60b73beb8d5e42bb](https://github.com/asterisk/asterisk/commit/92a5dd1003b737ae1cd2df4e60b73beb8d5e42bb)

## Related threats

- [Asterisk privilege escalation in ast_loggrabber via /tmp](https://junglewise.ai/threats/cve-2026-57203-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk OOH323 Q.931 parser denial of service](https://junglewise.ai/threats/cve-2026-57186-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk authorization bypass in ARI REST-over-WebSocket](https://junglewise.ai/threats/cve-2026-57200-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk NULL pointer dereference in Manager Interface HTTP digest authentication](https://junglewise.ai/threats/cve-2026-57195-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk stack buffer overflow in XMPP namespace prefix handling](https://junglewise.ai/threats/cve-2026-57188-asterisk-is-an-open-source-private-branch-exchange-and-telephony)