Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, user supplied/control values for Cookies and any GET variable query Parameter are directly interpolated into the HTML of the page using ast_str_append. The endpoint at GET /httpstatus is the potential vulnerable endpoint relating to asterisk/main /http.c. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 2 products
CVE-2026-23738 Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, user supplied/control va… https://www.cve.org/CVERecord?id=CVE-2026-23738
Post summary
CVE-2026-23738 has been disclosed as affecting specific Asterisk versions, with no PoC, exploit, or patch information provided.
12 of 12 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | sangoma | asterisk | - | - | - |
| App | sangoma | certified_asterisk | - | - | - |
| App | sangoma | certified_asterisk | 20.7 | - | - |
| App | sangoma | certified_asterisk | 20.7 | - | - |
| App | sangoma | certified_asterisk | 20.7 | - | - |
| App | sangoma | certified_asterisk | 20.7 | - | - |
| App | sangoma | certified_asterisk | 20.7 | - | - |
| App | sangoma | certified_asterisk | 20.7 | - | - |
| App | sangoma | certified_asterisk | 20.7 | - | - |
| App | sangoma | certified_asterisk | 20.7 | - | - |
| App | sangoma | certified_asterisk | 20.7 | - | - |
| App | sangoma | certified_asterisk | 20.7 | - | - |