CVE-2026-57193 in Asterisk
Summary
by MITRE • 10/26/2026
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver `res_config_ldap` may permit `LDAP filter injection` through a `SIP username`, allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The `res_config_ldap` module must be loaded and configured to access an LDAP server, which is not the default. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/26/2026
Asterisk serves as a widely deployed open-source implementation of private branch exchange systems and telephony toolkits, forming the backbone for many enterprise communication infrastructures. Within this ecosystem, the res_config_ldap module provides connectivity to Lightweight Directory Access Protocol servers, enabling centralized user authentication and configuration management. However, prior to specific patch releases including Asterisk versions 20.20.1, 21.12.3, 22.10.1, and 23.4.1, as well Certified Asterisk variants 20.7-cert11 and 22.8-cert3, a critical security flaw existed within this LDAP realtime driver. The vulnerability stems from improper validation of input data originating from SIP protocol headers, specifically the username field utilized during registration or authentication processes.
The technical core of this weakness lies in the construction of LDAP search filters. When an unauthenticated attacker sends crafted SIP packets containing maliciously formatted usernames, the Asterisk application fails to properly sanitize these inputs before embedding them into LDAP query strings. This lack of input validation allows for LDAP filter injection, a technique where special characters and logical operators are injected into the username field to alter the structure of the intended search query. By manipulating the syntax, an attacker can bypass expected filtering logic, effectively changing the scope or criteria of the directory lookup performed by the backend LDAP server.
This vulnerability is classified under CWE-90 as Improper Neutralization of Special Elements used in an SQL Command, adapted here for LDAP contexts, and aligns with ATT&CK technique T1586 which involves Compromise Accounts to gain initial access or escalate privileges within a network environment. The operational impact is significant because it allows an unauthenticated remote attacker to perform arbitrary queries against the connected LDAP directory. This capability can lead to information disclosure, where sensitive user attributes such as email addresses, phone numbers, group memberships, and other personally identifiable information are exposed. In severe cases, if combined with other vulnerabilities or misconfigurations, this could facilitate unauthorized access to telephony services or further lateral movement within the network by leveraging discovered credentials.
It is important to note that exploitation of this vulnerability requires specific conditions. The res_config_ldap module must be explicitly loaded and configured in the Asterisk environment to point toward an LDAP server, which is not a default configuration for many installations. Despite this prerequisite, organizations utilizing centralized directory services for telephony authentication are at risk if they have not applied the necessary updates. The remediation strategy involves upgrading to patched versions of Asterisk or Certified Asterisk that include fixes for input sanitization in the SIP username handling logic within the LDAP driver. Administrators should also consider implementing network-level access controls, such as firewalls restricting inbound SIP traffic to trusted sources only, and monitoring logs for anomalous registration attempts containing unusual character sequences indicative of injection attacks.