CVE-2026-57203 in Asterisk
Summary
by MITRE • 10/28/2026
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, `ast_loggrabber` executes a `Python script` from the world-writable `/tmp` directory. An attacker already authorized to open a shell session on the Asterisk server may place a malicious script there and gain elevated privileges or execute code when an administrator runs `ast_loggrabber` as a user with elevated privileges. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in the Asterisk telephony platform stems from a flawed implementation of privilege escalation mechanisms within the ast_loggrabber utility. Prior to the release of versions 20.20.1, 21.12.3, 22.10.1, and 23.4.1, as well as specific Certified Asterisk releases including 20.7-cert11 and 22.8-cert3, the application exhibited a critical insecure temporary file creation pattern. Specifically, ast_loggrabber was designed to execute Python scripts located in the /tmp directory without validating their integrity or ownership before execution. This behavior creates a classic race condition scenario where an attacker can exploit the predictable nature of temporary file paths and insufficient access controls to manipulate system behavior.
The core technical flaw lies in the use of a world-writable directory for storing executable content that is subsequently run with elevated privileges by administrators. In Unix-like operating systems, the /tmp directory is typically accessible to all users on the host machine. When ast_loggrabber attempts to load and execute a Python script from this location without verifying that the file was created by the current user or checking its permissions, it effectively trusts any content placed there by any authenticated local user. This represents a significant deviation from secure coding practices which dictate that temporary files should be created with restrictive permissions such as 0600 to ensure only the owner can read and write them, thereby preventing other users from tampering with the file contents before execution.
An attacker who has already gained authorized access to an Asterisk server shell session can leverage this vulnerability to achieve arbitrary code execution or privilege escalation. By placing a malicious Python script in the /tmp directory with appropriate permissions for reading by others, the attacker sets a trap that is triggered when an administrator runs ast_loggrabber as a user with higher privileges, such as root. Upon execution, the elevated process will run the attacker-controlled script within its security context. This allows the adversary to execute commands, exfiltrate sensitive data, install backdoors, or pivot further into the network under the guise of legitimate administrative activity. The impact is severe because it bypasses standard authentication and authorization controls by abusing a trusted application running with elevated rights.
This vulnerability aligns closely with Common Weakness Enumeration (CWE) categories such as CWE-377, which describes Insecure Temporary File Creation, and CWE-250, which covers Execution with Unnecessary Privileges. The attack vector is consistent with the MITRE ATT&CK framework technique T1068, specifically Subversion of Trusty Models or Exploitation for Privilege Escalation, where an attacker exploits a trusted process to gain higher-level access. It also reflects aspects of CWE-732, which pertains to Incorrect Permission Assignment for Critical Resource, as the underlying issue is the lack of restrictive file permissions on the temporary storage location used by the application.
To mitigate this risk, organizations must immediately upgrade Asterisk and Certified Asterisk installations to the fixed versions mentioned above: 20.20.1, 21.12.3, 22.10.1, 23.4.1 for standard releases, and 20.7-cert11 or 22.8-cert3 for certified variants. These updates address the insecure file handling logic by ensuring that temporary files are created with restrictive permissions or using secure alternatives such as mkstemp which guarantees atomic creation of unique filenames with appropriate access controls. Additionally, administrators should review their operational procedures to ensure that ast_loggrabber is not routinely executed with unnecessary elevated privileges if it does not strictly require root-level access for its intended function. Implementing strict file system monitoring and adhering to the principle of least privilege across all administrative tools can further reduce the attack surface associated with such utilities.