CVE-2024-57520

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-57520
Insecure Permissions vulnerability in asterisk v22 allows a remote attacker to execute arbitrary code via the action_createconfig function. NOTE: this is disputed by the Supplier because the impact is limited to creating empty files outside of the Asterisk product directory (aka directory traversal) and the attack can only be performed by a privileged user who has the ability to manage the configuration.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://gist.github.com/hyp164D1/ae76ab25acfbe263b2ed7b24b6e5c621 Third Party Advisory
https://github.com/asterisk/asterisk/issues/1122
Configurations

Configuration 1 (hide)

cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*
History

06 Nov 2025, 13:15

Type Values Removed Values Added
CPE cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*
Summary (en) Insecure Permissions vulnerability in asterisk v22 allows a remote attacker to execute arbitrary code via the action_createconfig function (en) Insecure Permissions vulnerability in asterisk v22 allows a remote attacker to execute arbitrary code via the action_createconfig function. NOTE: this is disputed by the Supplier because the impact is limited to creating empty files outside of the Asterisk product directory (aka directory traversal) and the attack can only be performed by a privileged user who has the ability to manage the configuration.
First Time Sangoma asterisk
Sangoma
References
  • () https://github.com/asterisk/asterisk/issues/1122 -
References () https://gist.github.com/hyp164D1/ae76ab25acfbe263b2ed7b24b6e5c621 - () https://gist.github.com/hyp164D1/ae76ab25acfbe263b2ed7b24b6e5c621 - Third Party Advisory

06 Feb 2025, 16:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
CWE CWE-732
Summary
  • (es) La vulnerabilidad de permisos inseguros en Asterisk v22 permite que un atacante remoto ejecute código arbitrario a través de la función action_createconfig

05 Feb 2025, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-05 22:15

Updated : 2025-11-06 13:15

NVD link : CVE-2024-57520

Mitre link : CVE-2024-57520

CVE.ORG link : CVE-2024-57520

JSON object : View

Products Affected

sangoma

  • asterisk
CWE
CWE-732

Incorrect Permission Assignment for Critical Resource