PT-2026-6747 · Asterisk · Asterisk

Thattotallyrealmyth · Published 2026-01-01 · Updated 2026-02-06 · CVE-2026-23738

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Asterisk versions prior to 20.7-cert9 Asterisk versions prior to 20.18.2 Asterisk versions prior to 21.12.1 Asterisk versions prior to 22.8.2 Asterisk versions prior to 23.2.2

Description Asterisk is a private branch exchange and telephony toolkit. User-controlled values from Cookies and GET query parameters are directly inserted into HTML pages using the ast str append function. The /httpstatus endpoint is potentially vulnerable. This can lead to the injection of user-supplied data into the HTML output.

Recommendations Update to Asterisk version 20.7-cert9 or later. Update to Asterisk version 20.18.2 or later. Update to Asterisk version 21.12.1 or later. Update to Asterisk version 22.8.2 or later. Update to Asterisk version 23.2.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-23738

GHSA-V6HP-WH3R-CWXH

Affected Products

Asterisk

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23738.json · Exploit
• https://github.com/asterisk/asterisk/security/advisories/GHSA-v6hp-wh3r-cwxh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23738 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-23738 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23738 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23738 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23738 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-23738 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23738 · Vendor Advisory
• https://twitter.com/CVEnew/status/2019821329977880590 · Twitter Post