Tags › Rtp Inject

FreeSWITCH: RTP Bleed, RTP Inject and DoS

We reported two FreeSWITCH media security issues as one finding before ClueCon 2025. They now have separate CVEs: one for RTP Bleed and Inject during call setup, another for one-way media denial on established calls. FreeSWITCH 1.11.2 addresses the latter, but mitigating the former also requires configuration.…

FreeSWITCH: RTP Bleed and RTP Inject through unvalidated source learning

• Authors:
  • Enable Security research team
• CVSS v4.0:
  • Base score: 9.3 Critical
  • Exploitability: High
  • Complexity: Low
  • Attack requirements: None
  • Vulnerable system: High availability impact
  • Subsequent system: High confidentiality and integrity impact
  • Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:H/SI:H/SA:N
• CVE: CVE-2026-119293
• Fixed versions: No default-configured release was verified to close this issue. FreeSWITCH 1.11.2 adds two opt-in channel variables that mitigated persistent takeover in our tests when configured before RTP session creation; verify the effective settings on later releases.
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2026-07-freeswitch-rtp-inject-rtp-bleed/
• Vendor Security Advisory: https://github.com/signalwire/freeswitch/security/advisories/GHSA-cw2f-3w8g-4x9q
• Vendor Patch: https://github.com/signalwire/freeswitch/commit/a38cd8073314f7da29b16743b8dbe52fd8505ba7
• Reproduction tools and Docker Compose before/after lab: https://github.com/EnableSecurity/advisories/tree/master/ES2026-07-freeswitch-rtp-inject-rtp-bleed
• Companion advisory: https://www.enablesecurity.com/advisories/ES2026-08-freeswitch-rtp-media-dos/
• Other references:
  • CWE-346: Origin Validation Error
  • CWE-940: Improper Verification of Source of a Communication Channel
  • FreeSWITCH 1.11.2 release
• Tested vulnerable versions: FreeSWITCH 1.10.12 and FreeSWITCH 1.11.2 with default settings
• Tested mitigated version: FreeSWITCH 1.11.2 with both new channel variables configured
• Affected versions:
  • FreeSWITCH 1.0.0 through 1.11.1 are affected in their default configuration.
  • FreeSWITCH 1.11.2 remains affected unless the new controls are configured before RTP session creation.
• Timeline:
  • First discovery and report to FreeSWITCH developers: 2025-06
  • Upstream hardening commit: 2026-08-08
  • FreeSWITCH 1.11.2 released: 2026-08-09
  • Enable Security verified vulnerable and mitigated behaviour: 2026-08-11
  • Enable Security completed additional advisory reproduction and stock-configuration validation: 2026-10-28
  • Enable Security submitted the two split GitHub advisories: 2026-10-29
  • Vendor advisory published with CVE listed: 2026-11-03

TL;DR

Upgrading to FreeSWITCH 1.11.2 alone does not close this issue. Configure both new RTP source-learning controls before RTP session creation; both default to zero.

rtpengine: RTP Inject and RTP Bleed vulnerabilities despite proper configuration

• CVSS v4.0
  • Exploitability: High
  • Complexity: Low
  • Vulnerable system: Medium
  • Subsequent system: Medium
  • Exploitation: High
  • Security requirements: High
  • Vector: link
• Other references: CVE-2025-53399
• Fixed versions: >= mr13.4.1.1
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2025-01-rtpengine-improper-behavior-bleed-inject/
• Reproduction tools: https://github.com/EnableSecurity/advisories/tree/master/ES2025-01-rtpengine-improper-behavior-bleed-inject
• Tested vulnerable versions: mr13.3.1.4 and lower
• Timeline:
  • First report: 2025-04-24
  • Triaged: 2025-04-30
  • Fix provided for testing: 2025-05-05
  • Various back and forth and more fixes: 2025-05 / 2025-06
  • Vendor applied all fixes satisfactorily to master branch: 2025-06-05
  • Enable Security verified and confirmed fix: 2025-06-26
  • Vendor release with fix (mr13.4.1.1): 2025-07-03
  • Enable Security advisory: 2025-07-31

Description

Media servers often support source address learning to dynamically adapt to network conditions and client behavior. This is especially useful in scenarios involving NAT where the source IP and port of incoming RTP packets may differ from what was initially signaled via SDP over SIP. However, this mechanism can be exploited for two types of attacks if malicious packets are accepted as legitimate:

Rtpengine RTP Injection and Media Bleed Vulnerabilities (CVE-2025-53399)

We published a critical security advisory for rtpengine affecting versions mr13.3.1.4 and lower, allowing RTP injection and media redirection attacks. These vulnerabilities can be exploited without man-in-the-middle positioning and affect both plaintext RTP and encrypted SRTP sessions. Organizations should upgrade to mr13.4.1.1 and review configuration settings.…

SIPVicious PRO incremental update - and Gitlab CI/CD examples

We just pushed out a new SIPVicious PRO update to our subscribing members! This version does not include any new major features. Instead, it fixes various bugs and brings missing but necessary features to various SIPVicious PRO tools. We have the following highlights in this update:

• Documentation now includes realistic Gitlab CI/CD examples
• The RTP fuzzer in the experimental version now supports SRTP
• Support for new SIP DoS flood request methods
• The RTP inject tool can now specify the RTP’s SSRC and payload ID
• The SIP password cracking tool now supports closing the connection upon each attempt
• The SIP ping utility supports INVITE

For the boring details, including a list of bug fixes, do read the release notes for v6.0.0-experimental.6 and v6.0.0-beta.6.