An authenticated ARI user who normally has only read‑only access can, under certain conditions, send write requests to the WebSocket interface. This bypass of the read‑only constraint allows the attacker to load arbitrary module files, effectively executing arbitrary code on the Asterisk server. The flaw combines a path traversal vulnerability (CWE‑22) with an authorization bypass (CWE‑863), resulting in a high‑severity remote code execution risk for the affected system.

Affected products include the Asterisk open source PBX and the Certified Asterisk distribution. Versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified 22.8‑cert3 carry the vulnerability; these releases must be identified and updated.

The CVSS score of 7.5 classifies the flaw as high severity. Although an EPSS score is not provided, there is no indication that this issue is currently being exploited, and it is not listed in the CISA KEV catalog. The attack requires that the Asterisk HTTP web server be enabled and reachable, and that the attacker possess valid read‑only ARI credentials. Because HTTP is disabled by default and bound to localhost when enabled, the attack surface is limited to environments where the web server is exposed to an external network or where ARI credentials are already compromised.