PT-2026-6749 · Asterisk · Asterisk

Thattotallyrealmyth · Published 2026-01-01 · Updated 2026-02-06 · CVE-2026-23740

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Asterisk versions prior to 20.7-cert9 Asterisk versions prior to 20.18.2 Asterisk versions prior to 21.12.1 Asterisk versions prior to 22.8.2 Asterisk versions prior to 23.2.2

Description Asterisk is a private branch exchange and telephony toolkit. A flaw exists where the ast coredumper component, when writing gdb init and output files to a world-writable directory, allows a user with write access to that directory to execute arbitrary commands as root or overwrite arbitrary files. This is achieved by controlling the gdb init file and output paths.

Recommendations Update Asterisk to version 20.7-cert9 or later. Update Asterisk to version 20.18.2 or later. Update Asterisk to version 21.12.1 or later. Update Asterisk to version 22.8.2 or later. Update Asterisk to version 23.2.2 or later.

Exploit

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2026-23740

GHSA-XPC6-X892-V83C

Affected Products

Asterisk

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23740.json · Exploit
• https://github.com/asterisk/asterisk/security/advisories/GHSA-xpc6-x892-v83c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23740 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23740 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23740 · Security Note
• https://ubuntu.com/security/CVE-2026-23740 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23740 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23740 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-23740 · Vendor Advisory
• https://twitter.com/CVEnew/status/2019821327155134933 · Twitter Post