ID
VAR-202602-0626
CVE
CVE-2026-23740
TITLE
Sangoma of Asterisk Vulnerabilities related to uncontrolled search path elements in multiple products, including
Trust: 0.8
DESCRIPTION
Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, when ast_coredumper writes its gdb init and output files to a directory that is world-writable (for example /tmp), an attacker with write permission(which is all users on a linux system) to that directory can cause root to execute arbitrary commands or overwrite arbitrary files by controlling the gdb init file and output paths. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2. 20.7-cert9 , 20.18.2 , 21.12.1 , 22.8.2 ,and 23.2.2 Fixed inAll information handled by the software may be leaked to the outside. All information handled by the software may be rewritten. Furthermore, the software may stop working completely. Furthermore, attacks that exploit this vulnerability will not affect other software
Trust: 1.62
AFFECTED PRODUCTS
| vendor: | sangoma | model: | certified asterisk | scope: | eq | version: | 16.8.0 | Trust: 1.0 |
| vendor: | sangoma | model: | asterisk | scope: | lt | version: | 21.12.1 | Trust: 1.0 |
| vendor: | sangoma | model: | asterisk | scope: | lt | version: | 20.18.2 | Trust: 1.0 |
| vendor: | sangoma | model: | asterisk | scope: | gte | version: | 23.0.0 | Trust: 1.0 |
| vendor: | sangoma | model: | asterisk | scope: | gte | version: | 21.0.0 | Trust: 1.0 |
| vendor: | sangoma | model: | asterisk | scope: | gte | version: | 22.0.0 | Trust: 1.0 |
| vendor: | sangoma | model: | certified asterisk | scope: | eq | version: | 18.9 | Trust: 1.0 |
| vendor: | sangoma | model: | asterisk | scope: | lt | version: | 22.8.2 | Trust: 1.0 |
| vendor: | sangoma | model: | asterisk | scope: | lt | version: | 23.2.2 | Trust: 1.0 |
| vendor: | sangoma | model: | certified asterisk | scope: | eq | version: | 13.13.0 | Trust: 1.0 |
| vendor: | sangoma | model: | certified asterisk | scope: | eq | version: | 20.7 | Trust: 1.0 |
| vendor: | sangoma | model: | certified asterisk | scope: | eq | version: | 16.8 | Trust: 1.0 |
| vendor: | sangoma | model: | asterisk | scope: | - | version: | - | Trust: 0.8 |
| vendor: | sangoma | model: | certified asterisk | scope: | - | version: | - | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-427 | Trust: 1.0 |
| problemtype: | Uncontrolled search path elements (CWE-427) [ others ] | Trust: 0.8 |
PATCH
| title: | ast_coredumper runs as root, and writes gdb init file to world writeable folder; leading to potential privilege escalation Advisory asterisk/asterisk GitHub | url: | https://github.com/asterisk/asterisk/security/advisories/GHSA-xpc6-x892-v83c | Trust: 0.8 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2026-23740 | Trust: 2.6 |
| db: | JVNDB | id: | JVNDB-2026-003103 | Trust: 0.8 |
REFERENCES
| url: | https://github.com/asterisk/asterisk/security/advisories/ghsa-xpc6-x892-v83c | Trust: 1.0 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2026-23740 | Trust: 0.8 |
SOURCES
| db: | JVNDB | id: | JVNDB-2026-003103 |
| db: | NVD | id: | CVE-2026-23740 |
LAST UPDATE DATE
2026-02-12T23:50:17.784000+00:00
SOURCES UPDATE DATE
| db: | JVNDB | id: | JVNDB-2026-003103 | date: | 2026-02-12T07:25:00 |
| db: | NVD | id: | CVE-2026-23740 | date: | 2026-02-10T18:25:39.730 |
SOURCES RELEASE DATE
| db: | JVNDB | id: | JVNDB-2026-003103 | date: | 2026-02-12T00:00:00 |
| db: | NVD | id: | CVE-2026-23740 | date: | 2026-02-06T17:16:26.290 |