CVE-2026-23741
Description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the asterisk/contrib/scripts/ast_coredumper runs as root, as noted by the NOTES tag on line 689 of the ast_coredumper file. The script will source the contents of /etc/asterisk/ast_debug_tools.conf, which resides in a folder that is writeable by the asterisk user:group. Due to the /etc/asterisk/ast_debug_tools.conf file following bash semantics and it being loaded; an attacker with write permissions may add or modify the file such that when the root ast_coredumper is run; it would source and thereby execute arbitrary bash code found in the /etc/asterisk/ast_debug_tools.conf. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
15cpe:2.3:a:sangoma:certified_asterisk:*:*:*:*:*:*:*:*+ 10 more
- cpe:2.3:a:sangoma:certified_asterisk:*:*:*:*:*:*:*:*range: <=18.9
- cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc1:*:*:*:*:*:*
- cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1-rc2:*:*:*:*:*:*
- cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1:*:*:*:*:*:*
- cpe:2.3:a:sangoma:certified_asterisk:20.7:cert2:*:*:*:*:*:*
- cpe:2.3:a:sangoma:certified_asterisk:20.7:cert3:*:*:*:*:*:*
- cpe:2.3:a:sangoma:certified_asterisk:20.7:cert4:*:*:*:*:*:*
- cpe:2.3:a:sangoma:certified_asterisk:20.7:cert5:*:*:*:*:*:*
- cpe:2.3:a:sangoma:certified_asterisk:20.7:cert6:*:*:*:*:*:*
- cpe:2.3:a:sangoma:certified_asterisk:20.7:cert7:*:*:*:*:*:*
- cpe:2.3:a:sangoma:certified_asterisk:20.7:cert8:*:*:*:*:*:*
- Range: before 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2
Patches
Vulnerability mechanics
References
1- github.com/asterisk/asterisk/security/advisories/GHSA-rvch-3jmx-3jf3nvdVendor Advisory
News mentions
0No linked articles in our index yet.