What is CVE-2026-57202?

CVE-2026-57202 is a high-severity vulnerability in Asterisk, classified under Privilege Defined With Unsafe Actions. CVSS score: 8.1/10. Published 2026-10-27.

How severe is CVE-2026-57202?

High severity. CVSS v3 base score is 8.1 out of 10.

Privilege escalation in Asterisk

CVE-2026-57202

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may use `setChannelVar` to execute write dialplan functions, including `FILE()` writes, even when `live_dangerously` in `asterisk.conf` is set to no. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Published 2026-10-27.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Asterisk — versions < 20.20.1, >= 21.0.0-pre1, < 21.12.3, >= 22.0.0-pre1, < 22.10.1
Asterisk Certified-Asterisk — versions < 20.7-cert11, >= 22.8-cert1-pre1, < 22.8-cert3

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-57202?: CVE-2026-57202 is a high-severity vulnerability in Asterisk, classified under Privilege Defined With Unsafe Actions. CVSS score: 8.1/10. Published 2026-10-27.
How severe is CVE-2026-57202?: High severity. CVSS v3 base score is 8.1 out of 10.