CVE-2026-23738

Published: Feb 6, 2026Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, user supplied/control values for Cookies and any GET variable query Parameter are directly interpolated into the HTML of the page using ast_str_append. The endpoint at GET /httpstatus is the potential vulnerable endpoint relating to asterisk/main /http.c. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.

Affected (15)

Products: Sangoma: Asterisk, Certified Asterisk

Sangoma

2 products

Asterisk

Certified Asterisk

Configuration A

15 vulnerable

Vulnerable Software	Affected Versions
Sangoma Asterisk	Up to 20.18.2
Sangoma Asterisk	From 21.0.0 to 21.12.1
Sangoma Asterisk	From 22.0.0 to 22.8.2
Sangoma Asterisk	From 23.0.0 to 23.2.2
Sangoma Certified Asterisk	Up to 18.9
Sangoma Certified Asterisk	Version 20.7 cert1-rc1
Sangoma Certified Asterisk	Version 20.7 cert1-rc2
Sangoma Certified Asterisk	Version 20.7 cert1
Sangoma Certified Asterisk	Version 20.7 cert2
Sangoma Certified Asterisk	Version 20.7 cert3
Sangoma Certified Asterisk	Version 20.7 cert4
Sangoma Certified Asterisk	Version 20.7 cert5
Sangoma Certified Asterisk	Version 20.7 cert6
Sangoma Certified Asterisk	Version 20.7 cert7
Sangoma Certified Asterisk	Version 20.7 cert8

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (1)

https://github.com/asterisk/asterisk/security/advisories/GHSA-v6hp-wh3r-cwxh

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.