The ast_coredumper script runs with root privileges and sources a configuration file that is normally owned by the asterisk user and group. Because that file is writable by non‑privileged users, an attacker can inject arbitrary Bash code that will be executed by the root process. This flaw allows the attacker to gain full system privileges, compromising confidentiality, integrity, and availability of the host. The weakness is classified as CWE‑427, indicating an improper privilege escalation due to unsanitized path or executable sourcing.

Asterisk versions prior to 20.7‑cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2 are affected. All installations that include the asterisk/contrib/scripts/ast_coredumper utility and that run as root pose risk if the configuration directory is writable by the asterisk user.

The vulnerability carries a high exploitation potential for any user with write access to /etc/asterisk/ast_debug_tools.conf. The EPSS score is reported as less than 1 %, indicating a very low likelihood of widespread observation, but the impact of exploitation is severe. The issue is not listed in the CISA KEV catalog, so no widespread exploits are currently known. Attackers would need local or remote means to modify the configuration file; once that is achieved, running the ast_coredumper will execute the attacker’s code as root.