Vulnerability record · CVE-2023-49294 · published 14 December 2023
CVE-2023-49294: Asterisk arbitrary file read via path traversal bypassing live_dangerously
Digium · Asterisk
Asterisk contains a path traversal flaw (CWE-22) that allows reading arbitrary files even when the live_dangerously setting is not enabled. The issue affects Asterisk before 18.20.1, 20.5.1, and 21.0.1, and certified-asterisk before 18.9-cert6. Because the setting is meant to restrict dangerous operations, the bypass undermines an intended security control and exposes sensitive files on the host.
Description
Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the `live_dangerously` is not enabled. This allows arbitrary files to be read. Asterisk versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, contain a fix for this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Automated analysis
high priorityCVSS 7.5 with network reachability, no authentication, and high EPSS percentile make this a high-priority patching target despite no KEV listing.
What it is
Asterisk contains a path traversal flaw (CWE-22) that allows reading arbitrary files even when the live_dangerously setting is not enabled. The issue affects Asterisk before 18.20.1, 20.5.1, and 21.0.1, and certified-asterisk before 18.9-cert6. Because the setting is meant to restrict dangerous operations, the bypass undermines an intended security control and exposes sensitive files on the host.
Impact
An attacker can read any file accessible to the Asterisk process, potentially exposing configuration files, credentials, and other sensitive data. There is no impact to integrity or availability per the CVSS vector.
Attack surface
The CVSS vector is AV:N/AC:L/PR:N/UI:N, indicating the flaw is reachable over the network with no authentication and no user interaction required. The description does not specify the exact interface, but the referenced manager.c suggests the Asterisk Manager Interface is involved.
Exploitation
The CVE is not listed in CISA KEV, but EPSS is 0.4557 (98.7th percentile), indicating a high likelihood of exploitation activity. References include a patch commit and vendor advisory, but no public exploit code is tagged.
What to do
- Upgrade to Asterisk 18.20.1, 20.5.1, or 21.0.1, or certified-asterisk 18.9-cert6 or later.
- Restrict network access to the Asterisk Manager Interface and other management services to trusted hosts only.
- Review and tighten file permissions for the Asterisk process to limit readable files.
- Monitor for unexpected file read activity by the Asterisk process.
Detection
- Monitor Asterisk logs for unusual file access or path traversal patterns.
- Alert on unexpected connections to the Asterisk Manager Interface from untrusted sources.
- Use file integrity monitoring to detect reads of sensitive files by the Asterisk process.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2023-49294 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-49294), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
