Cyber Resilience

CVE-2023-49786

Race Condition in Sangoma Certified Asterisk 13.13.0 … 18.9

Public PoCRace Condition
Published
14 December 2023
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.053 92th percentile
Risk Priority 64 floored blend · peak EPSS

Summary

CVE-2023-49786 is a high-severity Improper Check or Handling of Exceptional Conditions (CWE-703) vulnerability in Sangoma Certified Asterisk. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked in the top 8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1; as well as certified-asterisk prior to 18.9-cert6; Asterisk is susceptible to a DoS due to a race condition in the…

more

hello handshake phase of the DTLS protocol when handling DTLS-SRTP for media setup. This attack can be done continuously, thus denying new DTLS-SRTP encrypted calls during the attack. Abuse of this vulnerability may lead to a massive Denial of Service on vulnerable Asterisk servers for calls that rely on DTLS-SRTP. Commit d7d7764cb07c8a1872804321302ef93bf62cba05 contains a fix, which is part of versions 18.20.1, 20.5.1, 21.0.1, amd 18.9-cert6.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1499 Endpoint Denial of Service Impact
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-37457Same product: Digium Asterisk
CVE-2023-49294Same product: Digium Asterisk
CVE-2024-42491Same product: Sangoma Certified Asterisk
CVE-2025-49832Same product: Sangoma Certified Asterisk
CVE-2025-47779Same product: Sangoma Certified Asterisk
CVE-2025-54995Same product: Sangoma Certified Asterisk
CVE-2026-23739Same product: Sangoma Certified Asterisk
CVE-2025-47780Same product: Sangoma Certified Asterisk
CVE-2026-23738Same product: Sangoma Certified Asterisk
CVE-2024-0092Shared CWE-703

Affected Assets

digium
asterisk
21.0.0 · ≤ 18.20.1 · 19.0.0 — 20.5.1
sangoma
certified asterisk
13.13.0, 16.8.0, 18.9

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V10.4.2
  • V10.4.5
  • V15.1.3
  • V15.4.1

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-703

Implements explicit check and handling for the exceptional condition of audit logging process failure.

addresses: CWE-362

Accurate timestamps from internal clocks enable detection of race conditions by providing reliable event ordering in audit logs.

addresses: CWE-703

Establishing and monitoring system metrics with correlation and response actions helps identify and address improper handling of exceptional conditions.

addresses: CWE-703

Provides a defined response to detected conditions by restricting operation, ensuring exceptional conditions are handled rather than ignored or mishandled.

addresses: CWE-703

Contingency training equips users with defined procedures to check and respond to exceptional conditions during disruptions, reducing exploitation of mishandled errors.

addresses: CWE-703

Testing verifies the system's ability to detect, handle, and recover from exceptional conditions as part of the plan, reducing exploitability of improper exception handling.

addresses: CWE-703

Regular updates keep contingency procedures aligned with system changes, providing structured handling for exceptional conditions that would otherwise allow unmitigated exploitation.

addresses: CWE-703

Policy defines checks and handling for exceptional conditions arising from security incidents.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices explicitly require anticipating and correctly handling exceptional conditions during design and coding.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can detect race conditions, but does not prevent them at design or coding time.

prevents

Secure SDLC mandates concurrency controls and synchronization primitives that directly prevent race conditions.

prevents

Application security requirements can specify thread-safety and locking rules, but do not prescribe implementation details.

prevents

Secure architecture principles require proper synchronization and resource isolation, addressing the root cause of CWE-362.

prevents

Secure coding standards explicitly forbid unsafe concurrent access patterns and mandate atomic operations or locks.

none

Reporting of unhandled errors or exceptional conditions surfaces latent failure paths so they can be corrected before exploitation.

References