CVE-2023-49786

CVE-2023-49786 describes a Denial of Service (DoS) vulnerability in Asterisk, an open-source telephony toolkit, affecting versions prior to 18.20.1, 20.5.1, 21.0.1, and certified-asterisk prior to 18.9-cert6. This flaw stems from a race condition during the DTLS protocol's hello handshake phase when handling DTLS-SRTP for media setup. An attacker can continuously exploit this vulnerability to prevent new DTLS-SRTP encrypted calls, leading to a massive DoS on vulnerable Asterisk servers. The vulnerability has a CVSS score of 5.9 (Medium), indicating a network-based attack with high impact on availability and high attack complexity. There is no impact on confidentiality or integrity. Currently, there is no evidence of active exploitation, nor are there any public exploit modules available in Metasploit, Nuclei, or ExploitDB. The CVE has received minimal community discussion and media coverage, suggesting it is not widely known or actively targeted.