The vulnerability resides in the res_config_ldap module of Asterisk, where an LDAP filter can be injected through the SIP username field. When a SIP packet containing a crafted username reaches the server, the filter is incorporated into an LDAP query executed against the configured directory. This allows an unauthenticated sender to retrieve arbitrary LDAP directory attributes accessible to the Asterisk service, leading to confidential information disclosure. The flaw does not modify data or crash the system, so integrity and availability remain unaffected.

Versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1, and their Certified counterparts 20.7‑cert11 and 22.8‑cert3 are vulnerable when the res_config_ldap driver is loaded and configured to contact an LDAP server. All other releases and configurations lacking the driver are not affected.

The CVSS base score of 6.9 indicates medium severity. EPSS is not reported, and the vulnerability is not in the CISA KEV list, suggesting it is not actively exploited. Deployment can be exposed to remote attackers through SIP traffic (UDP/TCP ports 5060/5061), so an unauthenticated user who can reach the Asterisk instance may send the crafted packet. No prior authentication or elevated privileges are required, making this a notable remote information disclosure vector.