6.9
MediumCVSS 4.0 · from GitHub_M
CVE-2026-57203
Asterisk: Local privilege escalation through ast_loggrabber's world-writable helper location
asterisk · CWE-426 · CWE-426Affectedasterisk, certified-asterisk
FixNo fix listed yet.
PublishedOct 27, 21:48 · GitHub_M
ScoredOct 27 · 6.9 · GitHub_M
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:05 UTC
What we know
No known exploitation. CISA KEV, checked 22:05 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs local access to the machine. CVSS: local.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
Someone has to open, click or run something first. CVSS: user interaction required.
A successful attack can read data and change data. CVSS impact.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, `ast_loggrabber` executes a `Python script` from the world-writable `/tmp` directory. An attacker already authorized to open a shell session on the Asterisk server may place a malicious script there and gain elevated privileges or execute code when an administrator runs `ast_loggrabber` as a user with elevated privileges. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
From GitHub_M
Affected and fixed versions
ProductAffectedFixed inasterisk< 20.20.1–asterisk>= 21.0.0-pre1, < 21.12.3–asterisk>= 22.0.0-pre1, < 22.10.1–asterisk>= 23.0.0-pre1, < 23.4.1–certified-asterisk< 20.7-cert11–certified-asterisk>= 22.8-cert1-pre1, < 22.8-cert3–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known