The vulnerability affects the Asterisk open source telephony platform, where a world‑writable directory used by the ast_coredumper can be abused to cause the 'root' user to execute arbitrary commands. An attacker who can write to such a directory can control the gdb init file and the output paths of the core dumper, resulting in privilege escalation and arbitrary file overwrite. This flaw is consistent with the CWE definitions for Privilege Escalation: Local File Upload and Path Manipulation.

The affected product is the Asterisk PBX supplied by Sangoma. Versions earlier than 20.7‑cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2 are vulnerable. These releases have been patched in the corresponding certified releases: 20.7‑cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.

The EPSS score is recommended as <1%, indicating a low probability of exploitation, yet the flaw permits local attackers who can write to a world‑writable directory such as /tmp to gain root privileges. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a local user who can place a crafted gdb init file and specify output file paths that the core dumper will honor, leading to code execution as root.