7.0
HighCVSS 4.0 · from GitHub_M
CVE-2026-57190
Asterisk: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
asterisk · SQL injection · CWE-89Affectedasterisk, certified-asterisk
FixNo fix listed yet.
PublishedOct 27, 21:45 · GitHub_M
ScoredOct 27 · 7.0 · GitHub_M
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:06 UTC
What we know
No known exploitation. CISA KEV, checked 22:06 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
Description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the `PostgreSQL` and `TDS/MSSQL` Channel Event Log backends `cel_pgsql` and `cel_tds` may permit arbitrary SQL execution when untrusted data is set in the CEL `eventtype` column by the `CELGenUserEvent` dialplan application. The `cel_pgsql` or `cel_tds` backend must be loaded and configured, and the administrator must call `CELGenUserEvent` in the dialplan without ensuring that only valid data is passed to the application. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
From GitHub_M
Affected and fixed versions
ProductAffectedFixed inasterisk< 20.20.1–asterisk>= 21.0.0-pre1, < 21.12.3–asterisk>= 22.0.0-pre1, < 22.10.1–asterisk>= 23.0.0-pre1, < 23.4.1–certified-asterisk< 20.7-cert11–certified-asterisk>= 22.8-cert1-pre1, < 22.8-cert3–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known