Asterisk: ARI setChannelVar bypasses live_dangerously and allows FILE() writes

Summary

Asterisk, an open source PBX and telephony toolkit, lets an authenticated ARI user with read-only privileges run write dialplan functions through setChannelVar. This includes FILE() writes, even when live_dangerously is set to no. The attacker needs valid read-only ARI credentials, and the Asterisk HTTP server must be enabled and reachable; it is disabled by default and binds only to 127.0.0.1 by default.

Affected

• Asterisk before 20.20.1
• Asterisk 21.0.0-pre1 up to before 21.12.3
• Asterisk 22.0.0-pre1 up to before 22.10.1
• Asterisk 23.0.0-pre1 up to before 23.4.1
• Certified Asterisk before 20.7-cert11
• Certified Asterisk 22.8-cert1-pre1 up to before 22.8-cert3

Fixed in

• Asterisk 20.20.1
• Asterisk 21.12.3
• Asterisk 22.10.1
• Asterisk 23.4.1
• Certified Asterisk 20.7-cert11
• Certified Asterisk 22.8-cert3

Workaround

• Disable the Asterisk HTTP server if ARI is not required.
• If ARI is required, keep the HTTP server bound to localhost and block external access to it.
• Review and rotate ARI credentials, especially read-only accounts, and remove unused accounts.

These measures reduce exposure but do not fix the vulnerability.

Exploitation

• No public proof of concept known.
• Not known to be exploited in the wild.
• CISA SSVC assessment: exploitation none, not automatable, total technical impact.

Our recommendation

• Update Asterisk or Certified Asterisk to the fixed versions listed above.
• Check whether the HTTP server and ARI are exposed to the internet or to untrusted networks, and restrict access.
• Review ARI accounts and credentials and remove unused or former staff accounts.
• Test custom ARI applications after the update, because dangerous functions may no longer work without live_dangerously.
• Prioritise internet-exposed systems with ARI enabled.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-vrfp-mg3q-3959 github.com
• Asterisk 23.4.1 release github.com
• Asterisk 22.10.1 release github.com
• Asterisk 21.12.3 release github.com
• Asterisk 20.20.1 release github.com
• Certified Asterisk 20.7-cert11 release github.com
• Certified Asterisk 22.8-cert3 release github.com
• Upstream fix commit 8f8ccaf github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:53.