Asterisk up to 23.4.0 cel_pgsql/cel_tds CELGenUserEvent eventtype sql injection

Summaryinfo

A vulnerability was found in Asterisk up to 23.4.0. It has been declared as critical. Affected is the function CELGenUserEvent of the component cel_pgsql/cel_tds. Such manipulation of the argument eventtype leads to sql injection. This vulnerability is referenced as CVE-2026-57190. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Asterisk up to 23.4.0. It has been rated as critical. Affected by this issue is the function CELGenUserEvent of the component cel_pgsql/cel_tds. The manipulation of the argument eventtype with an unknown input leads to a sql injection vulnerability. Using CWE to declare the problem leads to CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the `PostgreSQL` and `TDS/MSSQL` Channel Event Log backends `cel_pgsql` and `cel_tds` may permit arbitrary SQL execution when untrusted data is set in the CEL `eventtype` column by the `CELGenUserEvent` dialplan application. The `cel_pgsql` or `cel_tds` backend must be loaded and configured, and the administrator must call `CELGenUserEvent` in the dialplan without ensuring that only valid data is passed to the application. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-57190 since 06/24/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1505.

Upgrading to version 20.20.1, 21.12.3, 22.10.1, 23.4.1, 20.7-cert11 or 22.8-cert3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-111401). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Communications System

Name

• Asterisk

Version

• 20.0
• 20.1
• 20.2
• 20.3
• 20.4
• 20.5
• 20.6
• 20.7
• 20.7-cert10
• 20.8
• 20.9
• 20.10
• 20.11
• 20.12
• 20.13
• 20.14
• 20.15
• 20.16
• 20.17
• 20.18
• 20.19
• 20.20.0
• 21.12.0
• 21.12.1
• 21.12.2
• 22.0
• 22.1
• 22.2
• 22.3
• 22.4
• 22.5
• 22.6
• 22.7
• 22.8
• 22.8-cert2
• 22.9
• 22.10.0
• 23.0
• 23.1
• 23.2
• 23.3
• 23.4.0

Website

• Product: https://github.com/asterisk/asterisk/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion