Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-49294 is a medium-severity Path Traversal (CWE-22) vulnerability in Sangoma Certified Asterisk. Its CVSS base score is 4.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked in the top 1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Asterisk, an open source private branch exchange and telephony toolkit, contains a path traversal flaw (CWE-22) in versions prior to 18.20.1, 20.5.1, and 21.0.1 as well as certified-asterisk releases before 18.9-cert6. The issue resides in the manager interface code and permits reading of arbitrary files on the host even when the live_dangerously setting remains disabled, resulting in a CVSS 4.9 vector that requires network access and high privileges.
An authenticated user with manager-interface credentials can supply crafted requests that traverse the file system and retrieve any readable file, exposing configuration data, credentials, or other sensitive content while leaving system integrity and availability unaffected.
Official patches and advisories direct administrators to upgrade immediately to Asterisk 18.20.1, 20.5.1, 21.0.1 or certified-asterisk 18.9-cert6; the correction is documented in the referenced GitHub commit and security advisory along with corresponding Debian LTS updates.
The associated EPSS score has remained flat at 0.1709 with no material increase since disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-53282
Vulnerability Data
Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any arbitrary file even when the `live_dangerously` is…
more
not enabled. This allows arbitrary files to be read. Asterisk versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, contain a fix for this issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.3.2
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Patching/maintenance can remediate known path-traversal flaws in deployed software (partial prevention of exploitability) but does nothing to stop the coding defect from being introduced in the first place.
PR.AA-05 defines and reviews access policies but does not address code-level pathname neutralization, so neither direction prevents CWE-22.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.