Tags › Rtp

FreeSWITCH: RTP Bleed, RTP Inject and DoS

We reported two FreeSWITCH media security issues as one finding before ClueCon 2025. They now have separate CVEs: one for RTP Bleed and Inject during call setup, another for one-way media denial on established calls. FreeSWITCH 1.11.2 addresses the latter, but mitigating the former also requires configuration.…

FreeSWITCH: RTP Bleed and RTP Inject through unvalidated source learning

• Authors:
  • Enable Security research team
• CVSS v4.0:
  • Base score: 9.3 Critical
  • Exploitability: High
  • Complexity: Low
  • Attack requirements: None
  • Vulnerable system: High availability impact
  • Subsequent system: High confidentiality and integrity impact
  • Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:H/SI:H/SA:N
• CVE: CVE-2026-119293
• Fixed versions: No default-configured release was verified to close this issue. FreeSWITCH 1.11.2 adds two opt-in channel variables that mitigated persistent takeover in our tests when configured before RTP session creation; verify the effective settings on later releases.
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2026-07-freeswitch-rtp-inject-rtp-bleed/
• Vendor Security Advisory: https://github.com/signalwire/freeswitch/security/advisories/GHSA-cw2f-3w8g-4x9q
• Vendor Patch: https://github.com/signalwire/freeswitch/commit/a38cd8073314f7da29b16743b8dbe52fd8505ba7
• Reproduction tools and Docker Compose before/after lab: https://github.com/EnableSecurity/advisories/tree/master/ES2026-07-freeswitch-rtp-inject-rtp-bleed
• Companion advisory: https://www.enablesecurity.com/advisories/ES2026-08-freeswitch-rtp-media-dos/
• Other references:
  • CWE-346: Origin Validation Error
  • CWE-940: Improper Verification of Source of a Communication Channel
  • FreeSWITCH 1.11.2 release
• Tested vulnerable versions: FreeSWITCH 1.10.12 and FreeSWITCH 1.11.2 with default settings
• Tested mitigated version: FreeSWITCH 1.11.2 with both new channel variables configured
• Affected versions:
  • FreeSWITCH 1.0.0 through 1.11.1 are affected in their default configuration.
  • FreeSWITCH 1.11.2 remains affected unless the new controls are configured before RTP session creation.
• Timeline:
  • First discovery and report to FreeSWITCH developers: 2025-06
  • Upstream hardening commit: 2026-08-08
  • FreeSWITCH 1.11.2 released: 2026-08-09
  • Enable Security verified vulnerable and mitigated behaviour: 2026-08-11
  • Enable Security completed additional advisory reproduction and stock-configuration validation: 2026-10-28
  • Enable Security submitted the two split GitHub advisories: 2026-10-29
  • Vendor advisory published with CVE listed: 2026-11-03

TL;DR

Upgrading to FreeSWITCH 1.11.2 alone does not close this issue. Configure both new RTP source-learning controls before RTP session creation; both default to zero.

FreeSWITCH: One-way media denial of service through late RTP source validation

• Authors:
  • Enable Security research team
• CVSS v4.0:
  • Base score: 8.7 High
  • Exploitability: High
  • Complexity: Low
  • Attack requirements: None
  • Vulnerable system: High availability impact, no confidentiality or integrity impact
  • Subsequent system: No separate impact scored
  • Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
• CVE: CVE-2026-119292
• Fixed versions: FreeSWITCH 1.11.2 prevents the complete media starvation reproduced on 1.10.12. Later releases containing the same fix are expected to provide the same protection. No configuration change is required for this post-learning path, although very high-rate floods can still cause packet loss.
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2026-08-freeswitch-rtp-media-dos/
• Vendor Security Advisory: https://github.com/signalwire/freeswitch/security/advisories/GHSA-w9xc-63w2-7q4x
• Vendor Patch: https://github.com/signalwire/freeswitch/commit/a38cd8073314f7da29b16743b8dbe52fd8505ba7
• Companion advisory: https://www.enablesecurity.com/advisories/ES2026-07-freeswitch-rtp-inject-rtp-bleed/
• Other references:
  • CWE-400: Uncontrolled Resource Consumption
  • FreeSWITCH 1.11.2 release
• Tested vulnerable version: FreeSWITCH 1.10.12
• Tested fixed version: FreeSWITCH 1.11.2
• Affected versions: FreeSWITCH 1.0.0 through 1.11.1, in the default configuration
• Timeline:
  • First discovery and report to FreeSWITCH developers: 2025-06
  • Upstream fix commit: 2026-08-08
  • FreeSWITCH 1.11.2 released: 2026-08-09
  • Enable Security ran the initial fix-validation matrix: 2026-08-11
  • Enable Security corrected and verified the stock-timer and bridged-call impact: 2026-10-28
  • Enable Security submitted the two split GitHub advisories: 2026-10-29
  • Vendor advisory published with CVE listed: 2026-11-03

TL;DR

FreeSWITCH 1.11.1 and earlier processed packets from an unrecognized RTP source before rejecting them. A sustained flood to an active media port could starve incoming audio from that call leg, causing one-way media in a bridged call even when SRTP was in use. FreeSWITCH 1.11.2 rejects these packets earlier without requiring a configuration change; very high-rate floods can still degrade media.

Introducing DVRTC: a vulnerable lab for RTC security

We’re releasing DVRTC (Damn Vulnerable Real-Time Communications), an intentionally vulnerable VoIP/WebRTC lab environment for security training and research. It comes with 7 hands-on exercises covering 12 attack paths, a live deployment at pbx1.dvrtc.net, and everything you need to start practicing RTC security testing.…

VoIP Eavesdropping: How it Works, Threats & Defense Tactics

VoIP eavesdropping is a critical security threat that can expose sensitive business and personal information. This comprehensive guide explains how attackers exploit VoIP vulnerabilities through packet sniffing, MITM attacks, and RTP Bleed, and provides actionable defense tactics including transport encryption, authentication, security audits, and network segmentation to protect your organization.…

rtpengine: RTP Inject and RTP Bleed vulnerabilities despite proper configuration

• CVSS v4.0
  • Exploitability: High
  • Complexity: Low
  • Vulnerable system: Medium
  • Subsequent system: Medium
  • Exploitation: High
  • Security requirements: High
  • Vector: link
• Other references: CVE-2025-53399
• Fixed versions: >= mr13.4.1.1
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2025-01-rtpengine-improper-behavior-bleed-inject/
• Reproduction tools: https://github.com/EnableSecurity/advisories/tree/master/ES2025-01-rtpengine-improper-behavior-bleed-inject
• Tested vulnerable versions: mr13.3.1.4 and lower
• Timeline:
  • First report: 2025-04-24
  • Triaged: 2025-04-30
  • Fix provided for testing: 2025-05-05
  • Various back and forth and more fixes: 2025-05 / 2025-06
  • Vendor applied all fixes satisfactorily to master branch: 2025-06-05
  • Enable Security verified and confirmed fix: 2025-06-26
  • Vendor release with fix (mr13.4.1.1): 2025-07-03
  • Enable Security advisory: 2025-07-31

Description

Media servers often support source address learning to dynamically adapt to network conditions and client behavior. This is especially useful in scenarios involving NAT where the source IP and port of incoming RTP packets may differ from what was initially signaled via SDP over SIP. However, this mechanism can be exploited for two types of attacks if malicious packets are accepted as legitimate:

Rtpengine RTP Injection and Media Bleed Vulnerabilities (CVE-2025-53399)

We published a critical security advisory for rtpengine affecting versions mr13.3.1.4 and lower, allowing RTP injection and media redirection attacks. These vulnerabilities can be exploited without man-in-the-middle positioning and affect both plaintext RTP and encrypted SRTP sessions. Organizations should upgrade to mr13.4.1.1 and review configuration settings.…

SIPVicious PRO incremental update - and Gitlab CI/CD examples

We just pushed out a new SIPVicious PRO update to our subscribing members! This version does not include any new major features. Instead, it fixes various bugs and brings missing but necessary features to various SIPVicious PRO tools. We have the following highlights in this update:

• Documentation now includes realistic Gitlab CI/CD examples
• The RTP fuzzer in the experimental version now supports SRTP
• Support for new SIP DoS flood request methods
• The RTP inject tool can now specify the RTP’s SSRC and payload ID
• The SIP password cracking tool now supports closing the connection upon each attempt
• The SIP ping utility supports INVITE

For the boring details, including a list of bug fixes, do read the release notes for v6.0.0-experimental.6 and v6.0.0-beta.6.

DEMO - An overview of the VoIP and RTC offensive security toolset, SIPVicious PRO

We pushed out a video that introduces the basics of SIPVicious PRO by demonstrating some of the attack tools and showing the building blocks for automating security testing of VoIP and WebRTC applications and infrastructure.

What follows is a transcript of the video.

Introduction

Hello, I’m Sandro Gauci from Enable Security. In this video, I’d like to show you what we have been working on, SIPVicious PRO! Let’s start by introducing the tools. SIPVicious PRO is a command-line toolset, meant to test the security of realtime communications, which includes Voice over IP as well as WebRTC infrastructure.