# CVE-2026-57203: Asterisk privilege escalation in ast_loggrabber via /tmp

Source: https://junglewise.ai/threats/cve-2026-57203-asterisk-is-an-open-source-private-branch-exchange-and-telephony  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-57203 · Severity: info · Published 2026-10-27

Asterisk is an open-source phone system toolkit used by organizations to route and manage calls. The ast_loggrabber utility, which administrators use to collect diagnostic logs, executes a Python script stored in the world-writable /tmp directory. An attacker with shell access can replace this script with malicious code to execute arbitrary commands with administrator privileges when the tool runs.

Technologies: [Asterisk](https://junglewise.ai/threats/technologies/asterisk), [Asterisk Certified Asterisk](https://junglewise.ai/threats/technologies/certified-asterisk). Vendors: [Asterisk](https://junglewise.ai/threats/vendors/asterisk).

## Quick answers

**Is CVE-2026-57203 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57203 being exploited in the wild.

**How severe is CVE-2026-57203?** Informational severity, published 27 October 2026.

**Which products and versions are affected?** Asterisk before 20.20.1, 21.x before 21.12.3, 22.x before 22.10.1, 23.x before 23.4.1; Asterisk Certified Asterisk 20.7 before 20.7-cert11, 22.8 before 22.8-cert3.

**Is there a fix for CVE-2026-57203?** Yes: fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57203 attacked?** It is attacked with local access, in a hosted service.

**Am I affected by CVE-2026-57203?** Check whether you run Asterisk or Asterisk Certified Asterisk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3

## Technical details

The vulnerability is a privilege escalation via insecure temporary file handling (CWE-377). The ast_loggrabber script loads ast_tsconvert.py from /tmp, which is world-writable; an authenticated local attacker can place a malicious Python script there. When an administrator runs ast_loggrabber with elevated privileges, the attacker's code executes with those privileges. The fix moves the script to a secure temporary directory with restrictive permissions.

## Affected products

- Asterisk Asterisk before 20.20.1, 21.x before 21.12.3, 22.x before 22.10.1, 23.x before 23.4.1
- Asterisk Certified Asterisk 20.7 before 20.7-cert11, 22.8 before 22.8-cert3

## Timeline

- 2026-10-27: disclosed

## References

- [https://github.com/asterisk/asterisk/commit/022407ec47adebe27b7ec8bcf5626e5a02fe1551](https://github.com/asterisk/asterisk/commit/022407ec47adebe27b7ec8bcf5626e5a02fe1551)
- [https://github.com/asterisk/asterisk/commit/a51c4e3d6bccce4bc4226c43e78952573a62f165](https://github.com/asterisk/asterisk/commit/a51c4e3d6bccce4bc4226c43e78952573a62f165)

## Related threats

- [Asterisk OOH323 Q.931 parser denial of service](https://junglewise.ai/threats/cve-2026-57186-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk authorization bypass in ARI REST-over-WebSocket](https://junglewise.ai/threats/cve-2026-57200-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk NULL pointer dereference in Manager Interface HTTP digest authentication](https://junglewise.ai/threats/cve-2026-57195-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk privilege escalation in REST Interface](https://junglewise.ai/threats/cve-2026-57202-asterisk-is-an-open-source-private-branch-exchange-and-telephony)
- [Asterisk stack buffer overflow in XMPP namespace prefix handling](https://junglewise.ai/threats/cve-2026-57188-asterisk-is-an-open-source-private-branch-exchange-and-telephony)