SB2026020664 - Multiple vulnerabilities in Asterisk Open Source and Certified Asterisk

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026020664

SB2026020664 - Multiple vulnerabilities in Asterisk Open Source and Certified Asterisk

Published: February 6, 2026

Security Bulletin ID SB2026020664
Severity
Low
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 secuirty vulnerabilities.


1) Incorrect default permissions (CVE-ID: CVE-2026-23741)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions for the "/etc/asterisk/ast_debug_tools.conf" file, which is writable by the asterisk user:group and is used by the "asterisk/contrib/scripts/ast_coredumper". A local user can modify the file and execute arbitrary OS commands as root.


2) Insecure library loading (CVE-ID: CVE-2026-23740)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to the application loads dynamic libraries in an insecure manner from the /tmp directory. A local user can place a specially crafted library file into the /tmp directory and execute arbitrary code on the system with root privileges. 


3) Cross-site scripting (CVE-ID: CVE-2026-23738)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to the "/httpstatus" page echos cookies and query string without sanitization. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.


4) XML External Entity injection (CVE-ID: CVE-2026-23739)

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input within the ast_xml_open() function in xml.c. A remote privileged user can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.

The vendor underlines that Asterisk currently doesn't allow untrusted or user-supplied XML to be used but a fix should be made in case that changes in the future.


Remediation

Install update from vendor's website.

References