CVE-2026-57202

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-57202", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-24T02:00:46.800Z", "datePublished": "2026-10-27T17:58:46.257Z", "dateUpdated": "2026-10-28T16:13:52.414Z"}, "containers": {"cna": {"title": "Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes", "problemTypes": [{"descriptions": [{"cweId": "CWE-267", "lang": "en", "description": "CWE-267: Privilege Defined With Unsafe Actions", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1220", "lang": "en", "description": "CWE-1220: Insufficient Granularity of Access Control", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/asterisk/asterisk/security/advisories/GHSA-vrfp-mg3q-3959", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-vrfp-mg3q-3959"}, {"name": "https://github.com/asterisk/asterisk/commit/8f8ccaf70a80e518147b0c35c0c252de4735446f", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/8f8ccaf70a80e518147b0c35c0c252de4735446f"}, {"name": "https://github.com/asterisk/asterisk/commit/92a5dd1003b737ae1cd2df4e60b73beb8d5e42bb", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/92a5dd1003b737ae1cd2df4e60b73beb8d5e42bb"}, {"name": "https://github.com/asterisk/asterisk/commit/ba04e7f1f98887c3c6e0dc4ddce663021f7e948a", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/ba04e7f1f98887c3c6e0dc4ddce663021f7e948a"}, {"name": "https://github.com/asterisk/asterisk/commit/bf9354267557ef6d6b75f5304faa243f595a5a66", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/bf9354267557ef6d6b75f5304faa243f595a5a66"}, {"name": "https://github.com/asterisk/asterisk/commit/caa4d50d9c3bf04fc979b5b2cdc5dc425772d845", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/caa4d50d9c3bf04fc979b5b2cdc5dc425772d845"}, {"name": "https://github.com/asterisk/asterisk/commit/d47b0b6e5a384746db194f751b53d559aba8dba9", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/d47b0b6e5a384746db194f751b53d559aba8dba9"}, {"name": "https://github.com/asterisk/asterisk/commit/d8614505b27688dec3a1d14554f52fda94712928", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/commit/d8614505b27688dec3a1d14554f52fda94712928"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/20.20.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/20.20.1"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/21.12.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/21.12.3"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/22.10.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/22.10.1"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/23.4.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/23.4.1"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11"}, {"name": "https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3"}, {"name": "https://github.com/asterisk/asterisk/tree/24.0.0-pre1", "tags": ["x_refsource_MISC"], "url": "https://github.com/asterisk/asterisk/tree/24.0.0-pre1"}], "affected": [{"vendor": "asterisk", "product": "asterisk", "versions": [{"version": "< 20.20.1", "status": "affected"}, {"version": ">= 21.0.0-pre1, < 21.12.3", "status": "affected"}, {"version": ">= 22.0.0-pre1, < 22.10.1", "status": "affected"}, {"version": ">= 23.0.0-pre1, < 23.4.1", "status": "affected"}]}, {"vendor": "asterisk", "product": "certified-asterisk", "versions": [{"version": "< 20.7-cert11", "status": "affected"}, {"version": ">= 22.8-cert1-pre1, < 22.8-cert3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-27T17:58:46.257Z"}, "descriptions": [{"lang": "en", "value": "Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may use `setChannelVar` to execute write dialplan functions, including `FILE()` writes, even when `live_dangerously` in `asterisk.conf` is set to no. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3."}], "source": {"advisory": "GHSA-vrfp-mg3q-3959", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-28T14:58:17.687111Z", "id": "CVE-2026-57202", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-28T16:13:52.414Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-57202", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-28T14:58:17.687111Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-28T14:58:18.720Z"}}], "cna": {"title": "Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes", "source": {"advisory": "GHSA-vrfp-mg3q-3959", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "asterisk", "product": "asterisk", "versions": [{"status": "affected", "version": "< 20.20.1"}, {"status": "affected", "version": ">= 21.0.0-pre1, < 21.12.3"}, {"status": "affected", "version": ">= 22.0.0-pre1, < 22.10.1"}, {"status": "affected", "version": ">= 23.0.0-pre1, < 23.4.1"}]}, {"vendor": "asterisk", "product": "certified-asterisk", "versions": [{"status": "affected", "version": "< 20.7-cert11"}, {"status": "affected", "version": ">= 22.8-cert1-pre1, < 22.8-cert3"}]}], "references": [{"url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-vrfp-mg3q-3959", "name": "https://github.com/asterisk/asterisk/security/advisories/GHSA-vrfp-mg3q-3959", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/asterisk/asterisk/commit/8f8ccaf70a80e518147b0c35c0c252de4735446f", "name": "https://github.com/asterisk/asterisk/commit/8f8ccaf70a80e518147b0c35c0c252de4735446f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/commit/92a5dd1003b737ae1cd2df4e60b73beb8d5e42bb", "name": "https://github.com/asterisk/asterisk/commit/92a5dd1003b737ae1cd2df4e60b73beb8d5e42bb", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/commit/ba04e7f1f98887c3c6e0dc4ddce663021f7e948a", "name": "https://github.com/asterisk/asterisk/commit/ba04e7f1f98887c3c6e0dc4ddce663021f7e948a", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/commit/bf9354267557ef6d6b75f5304faa243f595a5a66", "name": "https://github.com/asterisk/asterisk/commit/bf9354267557ef6d6b75f5304faa243f595a5a66", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/commit/caa4d50d9c3bf04fc979b5b2cdc5dc425772d845", "name": "https://github.com/asterisk/asterisk/commit/caa4d50d9c3bf04fc979b5b2cdc5dc425772d845", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/commit/d47b0b6e5a384746db194f751b53d559aba8dba9", "name": "https://github.com/asterisk/asterisk/commit/d47b0b6e5a384746db194f751b53d559aba8dba9", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/commit/d8614505b27688dec3a1d14554f52fda94712928", "name": "https://github.com/asterisk/asterisk/commit/d8614505b27688dec3a1d14554f52fda94712928", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/releases/tag/20.20.1", "name": "https://github.com/asterisk/asterisk/releases/tag/20.20.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/releases/tag/21.12.3", "name": "https://github.com/asterisk/asterisk/releases/tag/21.12.3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/releases/tag/22.10.1", "name": "https://github.com/asterisk/asterisk/releases/tag/22.10.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/releases/tag/23.4.1", "name": "https://github.com/asterisk/asterisk/releases/tag/23.4.1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11", "name": "https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3", "name": "https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/asterisk/asterisk/tree/24.0.0-pre1", "name": "https://github.com/asterisk/asterisk/tree/24.0.0-pre1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may use `setChannelVar` to execute write dialplan functions, including `FILE()` writes, even when `live_dangerously` in `asterisk.conf` is set to no. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-267", "description": "CWE-267: Privilege Defined With Unsafe Actions"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1220", "description": "CWE-1220: Insufficient Granularity of Access Control"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-27T17:58:46.257Z"}}}, "cveMetadata": {"cveId": "CVE-2026-57202", "state": "PUBLISHED", "dateUpdated": "2026-10-28T16:13:52.414Z", "dateReserved": "2026-06-24T02:00:46.800Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-27T17:58:46.257Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "asterisk", "vendor": "asterisk", "versions": [{"status": "affected", "version": "< 20.20.1"}, {"status": "affected", "version": ">= 21.0.0-pre1, < 21.12.3"}, {"status": "affected", "version": ">= 22.0.0-pre1, < 22.10.1"}, {"status": "affected", "version": ">= 23.0.0-pre1, < 23.4.1"}]}, {"product": "certified-asterisk", "vendor": "asterisk", "versions": [{"status": "affected", "version": "< 20.7-cert11"}, {"status": "affected", "version": ">= 22.8-cert1-pre1, < 22.8-cert3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may use `setChannelVar` to execute write dialplan functions, including `FILE()` writes, even when `live_dangerously` in `asterisk.conf` is set to no. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3."}], "id": "CVE-2026-57202", "lastModified": "2026-10-28T17:18:34.580", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57202", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-28T14:58:17.687111Z", "version": "2.0.3"}}]}, "published": "2026-10-27T18:17:37.550", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/8f8ccaf70a80e518147b0c35c0c252de4735446f"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/92a5dd1003b737ae1cd2df4e60b73beb8d5e42bb"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/ba04e7f1f98887c3c6e0dc4ddce663021f7e948a"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/bf9354267557ef6d6b75f5304faa243f595a5a66"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/caa4d50d9c3bf04fc979b5b2cdc5dc425772d845"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/d47b0b6e5a384746db194f751b53d559aba8dba9"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/commit/d8614505b27688dec3a1d14554f52fda94712928"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/20.20.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/21.12.3"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/22.10.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/23.4.1"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/security/advisories/GHSA-vrfp-mg3q-3959"}, {"source": "security-advisories@github.com", "url": "https://github.com/asterisk/asterisk/tree/24.0.0-pre1"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-267"}, {"lang": "en", "value": "CWE-1220"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "asterisk: Asterisk: Privilege escalation via setChannelVar in Asterisk REST Interface", "id": "2562324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562324"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-749", "details": ["Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may use `setChannelVar` to execute write dialplan functions, including `FILE()` writes, even when `live_dangerously` in `asterisk.conf` is set to no. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.", "A flaw was found in Asterisk. An authenticated remote attacker with read-only permissions to the Asterisk REST Interface (ARI) can bypass access controls by invoking the setChannelVar function. This vulnerability allows the attacker to execute restricted write operations, such as modifying arbitrary files on the underlying system, resulting in privilege escalation."], "name": "CVE-2026-57202", "public_date": "2026-10-27T17:58:46Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-57202\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-57202\nhttps://github.com/asterisk/asterisk/commit/8f8ccaf70a80e518147b0c35c0c252de4735446f\nhttps://github.com/asterisk/asterisk/commit/92a5dd1003b737ae1cd2df4e60b73beb8d5e42bb\nhttps://github.com/asterisk/asterisk/commit/ba04e7f1f98887c3c6e0dc4ddce663021f7e948a\nhttps://github.com/asterisk/asterisk/commit/bf9354267557ef6d6b75f5304faa243f595a5a66\nhttps://github.com/asterisk/asterisk/commit/caa4d50d9c3bf04fc979b5b2cdc5dc425772d845\nhttps://github.com/asterisk/asterisk/commit/d47b0b6e5a384746db194f751b53d559aba8dba9\nhttps://github.com/asterisk/asterisk/commit/d8614505b27688dec3a1d14554f52fda94712928\nhttps://github.com/asterisk/asterisk/releases/tag/20.20.1\nhttps://github.com/asterisk/asterisk/releases/tag/21.12.3\nhttps://github.com/asterisk/asterisk/releases/tag/22.10.1\nhttps://github.com/asterisk/asterisk/releases/tag/23.4.1\nhttps://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11\nhttps://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3\nhttps://github.com/asterisk/asterisk/security/advisories/GHSA-vrfp-mg3q-3959\nhttps://github.com/asterisk/asterisk/tree/24.0.0-pre1"], "statement": "This vulnerability is rated as having an Important severity because authenticated users with restricted read access can elevate their privileges to alter sensitive system resources, leading to potential unauthorized file modification. In typical deployments, exposure is limited because the HTTP interface and REST service are not enabled by default and bind solely to the local loopback address when initially activated. Exploitation is constrained by the prerequisite that an attacker must possess legitimate authentication credentials and the management interface must be exposed across the network.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,20.20.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[21.0.0-pre1,21.12.3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[22.0.0-pre1,22.10.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[23.0.0-pre1,23.4.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "asterisk", "source": "cna", "vendor": "asterisk"}, "product": "asterisk", "vendor": "asterisk"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,20.7-cert11)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[22.8-cert1-pre1,22.8-cert3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "certified-asterisk", "source": "cna", "vendor": "asterisk"}, "product": "certified_asterisk", "vendor": "asterisk"}], "created": "2026-10-27T19:45:07.215867+00:00", "updated": "2026-11-02T14:00:08.964110+00:00", "vendors": ["asterisk", "asterisk$PRODUCT$asterisk", "asterisk$PRODUCT$certified_asterisk"]}