CVE-2026-23738: XSS in Asterisk HTTP Status Page

Successful exploitation of CVE-2026-23738 allows an attacker to inject arbitrary JavaScript code into the Asterisk HTTP status page. This can be leveraged to steal user session cookies, redirect users to malicious websites, or deface the page. The impact is amplified if the Asterisk server is publicly accessible or integrated with other systems, as the attacker could potentially gain access to sensitive data or compromise the entire network. While the CVSS score is LOW, the ease of exploitation and potential for lateral movement make this a significant concern, particularly in environments with limited security controls.

1. Reserved2026-01-15
2. Published2026-02-06
3. EPSS updated2026-03-23

The primary mitigation for CVE-2026-23738 is to upgrade Asterisk to version 23.2.3 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter out malicious input in Cookies and GET parameters targeting the /httpstatus endpoint. Input validation on the server-side can also help prevent the injection of malicious scripts. Regularly review Asterisk configuration to ensure the /httpstatus endpoint is not publicly accessible if not required.