--- title: "CVE-2026-57202: Asterisk - Broken Access Control" description: "Asterisk < 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk < 20.7-cert11, 22.8-cert3 contain a broken access control vulnerability caused by improper restriction of write dialplan functions via setChannelVar in ARI, letting authenticated ARI attackers with read-only privileges execute write functions including FILE() writes, exploit requires enabled and reachable HTTP web server and valid read-only ARI credentials." url: https://panop.io/threat-heartbeat/CVE-2026-57202/ --- # CVE-2026-57202 Asterisk - Broken Access Control Asterisk < 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk < 20.7-cert11, 22.8-cert3 contain a broken access control vulnerability caused by improper restriction of write dialplan functions via setChannelVar in ARI, letting authenticated ARI attackers with read-only privileges execute write functions including FILE() writes, exploit requires enabled and reachable HTTP web server and valid read-only ARI credentials. CVSS base score 8.1 /10 High CISA KEV Not listed Public exploit None known Authentication Required EPSS 0.44% chance of exploitation in 30 days [View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-57202) ## Details Type Broken Access Control Impact Data Tampering CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N Published 27 October 2026 Updated 29 October 2026 Weakness [CWE-267](https://cwe.mitre.org/data/definitions/267.html) ## Vendor fix Update to versions 20.20.1, 21.12.3, 22.10.1, 23.4.1 or Certified Asterisk 20.7-cert11, 22.8-cert3 or later. Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them. ## References - [https://nvd.nist.gov/vuln/detail/CVE-2026-57202](https://nvd.nist.gov/vuln/detail/CVE-2026-57202) - [https://github.com/asterisk/asterisk/commit/92a5dd1003b737ae1cd2df4e60b73beb8d5e42bb](https://github.com/asterisk/asterisk/commit/92a5dd1003b737ae1cd2df4e60b73beb8d5e42bb) - [https://github.com/asterisk/asterisk/commit/bf9354267557ef6d6b75f5304faa243f595a5a66](https://github.com/asterisk/asterisk/commit/bf9354267557ef6d6b75f5304faa243f595a5a66) - [https://github.com/asterisk/asterisk/commit/caa4d50d9c3bf04fc979b5b2cdc5dc425772d845](https://github.com/asterisk/asterisk/commit/caa4d50d9c3bf04fc979b5b2cdc5dc425772d845) - [https://github.com/asterisk/asterisk/commit/d8614505b27688dec3a1d14554f52fda94712928](https://github.com/asterisk/asterisk/commit/d8614505b27688dec3a1d14554f52fda94712928) - [https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11](https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11) - [https://github.com/asterisk/asterisk/security/advisories/GHSA-vrfp-mg3q-3959](https://github.com/asterisk/asterisk/security/advisories/GHSA-vrfp-mg3q-3959) - [https://github.com/asterisk/asterisk/commit/ba04e7f1f98887c3c6e0dc4ddce663021f7e948a](https://github.com/asterisk/asterisk/commit/ba04e7f1f98887c3c6e0dc4ddce663021f7e948a) - [https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3](https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3) - [https://github.com/asterisk/asterisk/tree/24.0.0-pre1](https://github.com/asterisk/asterisk/tree/24.0.0-pre1) - [https://github.com/asterisk/asterisk/commit/d47b0b6e5a384746db194f751b53d559aba8dba9](https://github.com/asterisk/asterisk/commit/d47b0b6e5a384746db194f751b53d559aba8dba9) - [https://github.com/asterisk/asterisk/releases/tag/21.12.3](https://github.com/asterisk/asterisk/releases/tag/21.12.3) - [https://github.com/asterisk/asterisk/releases/tag/22.10.1](https://github.com/asterisk/asterisk/releases/tag/22.10.1) - [https://github.com/asterisk/asterisk/commit/8f8ccaf70a80e518147b0c35c0c252de4735446f](https://github.com/asterisk/asterisk/commit/8f8ccaf70a80e518147b0c35c0c252de4735446f) - [https://github.com/asterisk/asterisk/releases/tag/20.20.1](https://github.com/asterisk/asterisk/releases/tag/20.20.1) - [https://github.com/asterisk/asterisk/releases/tag/23.4.1](https://github.com/asterisk/asterisk/releases/tag/23.4.1) [← All CVEs](https://panop.io/threat-heartbeat/) ## What this record can't tell you - Whether you run the affected software, and where - Whether an attacker can actually reach and exploit it - The misconfigurations that never get a CVE number - What it would cost the business, ranked into what to fix first Panop answers these inside your environment, for this CVE and every other finding. [Book a demo](https://panop.io/demo)