{"id":"CVE-2026-57193","aliases":[],"cve":{"records":[{"id":"CVE-2026-57193","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-06-24T02:00:46.800Z","published":"2026-10-26T19:46:01.924Z","modified":"2026-10-31T01:46:55.030Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-26T19:46:01.924Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-10-31T01:46:55.030Z"}],"references":[{"url":"https://github.com/asterisk/asterisk/security/advisories/GHSA-r6c2-hwc2-j4mp","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/asterisk/asterisk/commit/04aa482212e43b292817444eb4de35499f4b1568","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/asterisk/asterisk/commit/14968f2f440ea0dd983caa4f477237a5224904dd","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/asterisk/asterisk/commit/23c01b6d359c5d85da725beea89e394a6c031c5d","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/asterisk/asterisk/commit/7e1ae09594a101950398cc6aff2dd2e5ab314884","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/asterisk/asterisk/commit/8170a6bfa75994e7617a8b9d7fe7a7140b70cbe2","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/asterisk/asterisk/commit/dd0c768d9e9678e4cb1ed95689a254a61452239b","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/asterisk/asterisk/commit/ef280572a034cac3994075298facb1999778ee0d","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/asterisk/asterisk/releases/tag/20.20.1","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/asterisk/asterisk/releases/tag/21.12.3","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/asterisk/asterisk/releases/tag/22.10.1","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/asterisk/asterisk/releases/tag/23.4.1","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/asterisk/asterisk/tree/24.0.0-pre1","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-943","description":"CWE-943: Improper Neutralization of Special Elements in Data Query Logic","source":"GitHub_M"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-10-31T01:46:45.323083Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Asterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver `res_config_ldap` may permit `LDAP filter injection` through a `SIP username`, allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The `res_config_ldap` module must be loaded and configured to access an LDAP server, which is not the default. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.","score":6.9,"severity":"medium","published":"2026-10-26T19:46:01.924Z","modified":"2026-10-31T01:46:55.030Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"asterisk","name":"asterisk","platforms":[],"versions":[{"version":"< 20.20.1","status":"affected"},{"version":">= 21.0.0-pre1, < 21.12.3","status":"affected"},{"version":">= 22.0.0-pre1, < 22.10.1","status":"affected"},{"version":">= 23.0.0-pre1, < 23.4.1","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-57193"},{"vendor":"asterisk","name":"certified-asterisk","platforms":[],"versions":[{"version":"< 20.7-cert11","status":"affected"},{"version":">= 22.8-cert1-pre1, < 22.8-cert3","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-57193"}],"remediation":[],"references":["https://github.com/asterisk/asterisk/security/advisories/GHSA-r6c2-hwc2-j4mp","https://github.com/asterisk/asterisk/commit/04aa482212e43b292817444eb4de35499f4b1568","https://github.com/asterisk/asterisk/commit/14968f2f440ea0dd983caa4f477237a5224904dd","https://github.com/asterisk/asterisk/commit/23c01b6d359c5d85da725beea89e394a6c031c5d","https://github.com/asterisk/asterisk/commit/7e1ae09594a101950398cc6aff2dd2e5ab314884","https://github.com/asterisk/asterisk/commit/8170a6bfa75994e7617a8b9d7fe7a7140b70cbe2","https://github.com/asterisk/asterisk/commit/dd0c768d9e9678e4cb1ed95689a254a61452239b","https://github.com/asterisk/asterisk/commit/ef280572a034cac3994075298facb1999778ee0d","https://github.com/asterisk/asterisk/releases/tag/20.20.1","https://github.com/asterisk/asterisk/releases/tag/21.12.3","https://github.com/asterisk/asterisk/releases/tag/22.10.1","https://github.com/asterisk/asterisk/releases/tag/23.4.1","https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11","https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3","https://github.com/asterisk/asterisk/tree/24.0.0-pre1"],"sources":[{"name":"CVE","id":"CVE-2026-57193","modified":"2026-10-31T01:46:55.030Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-57193"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":6.9}],"sourceAffected":[],"observedAt":"2026-10-31T01:57:39.820Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T09:35:34.504Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-31T02:00:48.130Z","attemptedAt":"2026-10-31T02:00:48.130Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-31T02:00:36.887Z","attemptedAt":"2026-10-31T02:00:36.887Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-31T02:00:36.928Z","attemptedAt":"2026-10-31T02:00:36.928Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-31T02:00:35.844Z","attemptedAt":"2026-10-31T02:00:35.844Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-57193","url":"https://www.first.org/epss/","probability":0.01963,"percentile":0.80321,"date":"2026-10-30","checkedAt":"2026-10-31T02:00:35.844Z"},{"source":"ENISA EUVD","id":"EUVD-2026-110081","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-110081","modified":"Oct 26, 2026, 7:46:01 PM","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","checkedAt":"2026-10-31T02:00:36.928Z"},{"source":"NVD","id":"CVE-2026-57193","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57193","modified":"2026-10-27T15:08:50.630","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-10-31T02:00:48.130Z"}],"aiSummary":{"text":"Asterisk versions prior to 20.20.1, 21.12.3, 22.10.1, and 23.4.1, and Certified Asterisk versions prior to 20.7-cert11 and 22.8-cert3, may permit LDAP filter injection via a SIP username, allowing an unauthenticated attacker to disclose information. The res_config_ldap module must be loaded and configured. This issue affects Asterisk and Certified Asterisk.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T08:57:30.387Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-57193"}]}}