Tags › Rtp Bleed

FreeSWITCH: RTP Bleed, RTP Inject and DoS

We reported two FreeSWITCH media security issues as one finding before ClueCon 2025. They now have separate CVEs: one for RTP Bleed and Inject during call setup, another for one-way media denial on established calls. FreeSWITCH 1.11.2 addresses the latter, but mitigating the former also requires configuration.…

FreeSWITCH: RTP Bleed and RTP Inject through unvalidated source learning

• Authors:
  • Enable Security research team
• CVSS v4.0:
  • Base score: 9.3 Critical
  • Exploitability: High
  • Complexity: Low
  • Attack requirements: None
  • Vulnerable system: High availability impact
  • Subsequent system: High confidentiality and integrity impact
  • Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:H/SI:H/SA:N
• CVE: CVE-2026-119293
• Fixed versions: No default-configured release was verified to close this issue. FreeSWITCH 1.11.2 adds two opt-in channel variables that mitigated persistent takeover in our tests when configured before RTP session creation; verify the effective settings on later releases.
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2026-07-freeswitch-rtp-inject-rtp-bleed/
• Vendor Security Advisory: https://github.com/signalwire/freeswitch/security/advisories/GHSA-cw2f-3w8g-4x9q
• Vendor Patch: https://github.com/signalwire/freeswitch/commit/a38cd8073314f7da29b16743b8dbe52fd8505ba7
• Reproduction tools and Docker Compose before/after lab: https://github.com/EnableSecurity/advisories/tree/master/ES2026-07-freeswitch-rtp-inject-rtp-bleed
• Companion advisory: https://www.enablesecurity.com/advisories/ES2026-08-freeswitch-rtp-media-dos/
• Other references:
  • CWE-346: Origin Validation Error
  • CWE-940: Improper Verification of Source of a Communication Channel
  • FreeSWITCH 1.11.2 release
• Tested vulnerable versions: FreeSWITCH 1.10.12 and FreeSWITCH 1.11.2 with default settings
• Tested mitigated version: FreeSWITCH 1.11.2 with both new channel variables configured
• Affected versions:
  • FreeSWITCH 1.0.0 through 1.11.1 are affected in their default configuration.
  • FreeSWITCH 1.11.2 remains affected unless the new controls are configured before RTP session creation.
• Timeline:
  • First discovery and report to FreeSWITCH developers: 2025-06
  • Upstream hardening commit: 2026-08-08
  • FreeSWITCH 1.11.2 released: 2026-08-09
  • Enable Security verified vulnerable and mitigated behaviour: 2026-08-11
  • Enable Security completed additional advisory reproduction and stock-configuration validation: 2026-10-28
  • Enable Security submitted the two split GitHub advisories: 2026-10-29
  • Vendor advisory published with CVE listed: 2026-11-03

TL;DR

Upgrading to FreeSWITCH 1.11.2 alone does not close this issue. Configure both new RTP source-learning controls before RTP session creation; both default to zero.

Introducing DVRTC: a vulnerable lab for RTC security

We’re releasing DVRTC (Damn Vulnerable Real-Time Communications), an intentionally vulnerable VoIP/WebRTC lab environment for security training and research. It comes with 7 hands-on exercises covering 12 attack paths, a live deployment at pbx1.dvrtc.net, and everything you need to start practicing RTC security testing.…

VoIP Eavesdropping: How it Works, Threats & Defense Tactics

VoIP eavesdropping is a critical security threat that can expose sensitive business and personal information. This comprehensive guide explains how attackers exploit VoIP vulnerabilities through packet sniffing, MITM attacks, and RTP Bleed, and provides actionable defense tactics including transport encryption, authentication, security audits, and network segmentation to protect your organization.…

rtpengine: RTP Inject and RTP Bleed vulnerabilities despite proper configuration

• CVSS v4.0
  • Exploitability: High
  • Complexity: Low
  • Vulnerable system: Medium
  • Subsequent system: Medium
  • Exploitation: High
  • Security requirements: High
  • Vector: link
• Other references: CVE-2025-53399
• Fixed versions: >= mr13.4.1.1
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2025-01-rtpengine-improper-behavior-bleed-inject/
• Reproduction tools: https://github.com/EnableSecurity/advisories/tree/master/ES2025-01-rtpengine-improper-behavior-bleed-inject
• Tested vulnerable versions: mr13.3.1.4 and lower
• Timeline:
  • First report: 2025-04-24
  • Triaged: 2025-04-30
  • Fix provided for testing: 2025-05-05
  • Various back and forth and more fixes: 2025-05 / 2025-06
  • Vendor applied all fixes satisfactorily to master branch: 2025-06-05
  • Enable Security verified and confirmed fix: 2025-06-26
  • Vendor release with fix (mr13.4.1.1): 2025-07-03
  • Enable Security advisory: 2025-07-31

Description

Media servers often support source address learning to dynamically adapt to network conditions and client behavior. This is especially useful in scenarios involving NAT where the source IP and port of incoming RTP packets may differ from what was initially signaled via SDP over SIP. However, this mechanism can be exploited for two types of attacks if malicious packets are accepted as legitimate:

Rtpengine RTP Injection and Media Bleed Vulnerabilities (CVE-2025-53399)

We published a critical security advisory for rtpengine affecting versions mr13.3.1.4 and lower, allowing RTP injection and media redirection attacks. These vulnerabilities can be exploited without man-in-the-middle positioning and affect both plaintext RTP and encrypted SRTP sessions. Organizations should upgrade to mr13.4.1.1 and review configuration settings.…

DEMO - An overview of the VoIP and RTC offensive security toolset, SIPVicious PRO

We pushed out a video that introduces the basics of SIPVicious PRO by demonstrating some of the attack tools and showing the building blocks for automating security testing of VoIP and WebRTC applications and infrastructure.

What follows is a transcript of the video.

Introduction

Hello, I’m Sandro Gauci from Enable Security. In this video, I’d like to show you what we have been working on, SIPVicious PRO! Let’s start by introducing the tools. SIPVicious PRO is a command-line toolset, meant to test the security of realtime communications, which includes Voice over IP as well as WebRTC infrastructure.