Our news
Refreshed
the coturn security configuration guide through 4.18.0, and fixed our
own TLS-only advice
I updated our coturn
security configuration guide to cover everything up to 4.18.0.
Since the June
refresh, coturn has shipped 4.15 through 4.18, mostly security
fixes.
The most important fix was to our own advice. The guide said
no-udp gives you a TCP/TLS-only server that spoofed
reflection traffic cannot reach. But before 4.17.0, coturn turned DTLS
on by itself whenever it found a valid certificate and key, so setting
up TLS also opened a DTLS listener that no-udp left
running. On 4.16.x and older, add no-dtls. From 4.17.0,
DTLS is off unless you add dtls.
If you’re upgrading, watch for:
no-dtls and no-cli were removed in 4.18.0,
so drop them from your config- The log format changed in both 4.17.0 and 4.18.0, which will break
log parsers and alert rules
- Stateless nonces are on by default from 4.17.0; load-balanced setups
want a shared
stateless-nonce-secret
FreeSWITCH
api-chat: registered users can exploit it too
In August,
I linked the api-chat takeovers to outdated FreeSWITCH installations
that still accept unauthenticated SIP MESSAGE requests (CVE-2021-37624).
That understated the problem. In versions up to and including 1.11.2,
anyone whose MESSAGE requests FreeSWITCH accepts can address one to
sip:api+<command>@..., and FreeSWITCH will run
<command> as an API command. Those commands include
system, which runs OS commands.
Enabling authentication does not close this off: any registered user
or trusted peer can still do it. So one compromised SIP account, such as
a phone with a weak or leaked password, is enough to take over the whole
server.
Upgrade to 1.11.3,
which places api-chat behind a new enable-chat-api-proto
setting that is off by default (PR #3135
for mod_sofia, PR #3136
for mod_verto). Then leave that setting off.
Kamailio’s
Diameter and IMS bugs: why you won’t get an advisory for them
Kamailio had a wave of memory-safety reports in its CDP (Diameter)
and IMS modules over the last few weeks, several of them LLM-assisted.
We reproduced both CDP bugs in our lab. None of them came with a
Kamailio security advisory, and that is by design.
Kamailio’s security
policy covers 128 modules. Everything else, including CDP, the IMS
modules and lrkproxy, is handled as an ordinary public bug, on the
reasoning that CDP and IMS run in secure environments with “trusted and
certified UAs”. On #4876,
maintainer Henning Westerholt said reports have multiplied with LLM
tools, which is why the project narrowed its security process to a list
of modules earlier this year. CDP isn’t on that list.
That “secure environments” argument is the old telecom walled garden.
The trusted UAs are subscribers’ phones, and in some networks a handset
on the IMS APN gets direct
IP access to the IMS core. The #4876 overflow even happens before
any Diameter peer is identified. If you run these modules, don’t expect
an advisory: watch the public issues yourself and treat your network
perimeter as the security boundary.
What to fix:
- CDP (#4876, #4909):
fixed in Kamailio
6.0.8; there is no fixed 6.1 release yet, so 6.1 needs a branch
build. Restrict network access to the Diameter acceptor and keep
AcceptUnknownPeers off.
lrkproxy (#4920, #4957): one
overflow is only partly fixed and another is still open. Disable it or
keep untrusted SIP away from it.- The IMS registrar and
ims_qos_npn modules have
overflows too (#4886, #4954, #4953).
What’s happening?
WeWorm:
a zero-click bug in WeChat’s VoIP stack, and the caveats
On 8 September Calif published WeWorm, a demo worm that
spreads through WeChat voice calls on Android and iOS. Calif is Thai
Duong’s company (BEAST, CRIME and POODLE). Calif’s post and the coverage
lead with “a billion phones” and an AI-built worm. The finding is
serious, but the caveats in Calif’s own post mostly didn’t make it into
the coverage.
What they actually say:
- The bug: memory corruption in WeChat’s VoIP stack.
No other details, no CVE. The write-up is kept for an upcoming
conference.
- Zero-click, before the answer: the exploit fires
while the phone is still ringing. Answering doesn’t matter, and
declining only stops that attempt.
- Impact: code execution inside WeChat, which means
full control of the account (read and send messages, place calls).
Taking over the device needs other Android and iOS bugs chained on top,
so “a billion phones” really means a billion accounts.
- Precondition: the attacker has to be on the
victim’s friend list. Calif’s answer is that you compromise a friend
first, which is exactly what the worm does: the attacker calls a victim,
and the victim’s account calls the next victim.
- AI: they say AI found the bug and helped write the
first exploit in about two days.
The worm is a demo with three phones, and the code was never
released. The demo
video shows the attacker’s Android phone taking over an iPhone’s
WeChat while it rings, and the hijacked iPhone then doing the same to a
second Pixel. Tencent fixed it in Android 8.0.77 and iOS 8.0.76 on 21
August, blocked it server-side by 28 August, and told
The Register it has “no evidence that the issue was exploited”. Also
in Calif’s timeline: their WeChat accounts were banned for four days,
the day after they reported the bug. We’ve seen this before: Yealink banned
the RPS account of the researchers who reported its provisioning
flaws in 2025.
The part that matters for RTC: call setup is attack surface that
requires no user interaction. The client parses what the caller sends
before the user has decided anything, which is how NSO exploited
WhatsApp too. We look forward to the talk!
Sangoma
Switchvox: CVE-2026-9586 exploited in the wild 47 days after the
patch
The critical Switchvox SMB bug from Cameron Lischke’s advisories we
covered in
July, an unauthenticated SQL injection in the /pa
endpoint (CVE-2026-9586,
CVSS 9.3), is now being exploited. Sangoma has an
open incident for on-premises systems (cloud instances are not
affected) and says exposed systems were at risk “regardless of password
strength”. The fix shipped in 8.4.0.2 on 14 July.
The vulnerable query runs as the PostgreSQL superuser, so one request
gets a shell via COPY TO PROGRAM. Horizon3’s honeypots were
hit exactly this way on 30 August, as Zach Hanley’s team describes
in its disclosure, and CISA added the CVE to KEV
on 2 September. To check whether you were hit, look for injected SQL in
/var/log/switchvox/db-quirks.log.
Upgrading does not clean a compromised box. Restore a snapshot or
backup from before 28 August and then upgrade, or do a clean install of
8.4.0.2, and close the admin and user portals and APIs to untrusted
networks first. Some operators on the Outages mailing list said they
found backdoors in backup files, so a recent backup may not be safe
either.
The real failure is how the fix was announced: a banner in the admin
portal, shown only after login. A notification that you only see once
you log in to the system that is being exploited is not much of a
notification.
OpenSIPS: sixteen
advisories in two batches
OpenSIPS published five
advisories on 7 September and eleven on 28 September, none with a
CVE yet. Almost all are in specific modules, so what matters is whether
your script loads them. Upgrade to 4.0.2 or 3.6.9 (tagged 8
September).
It’s interesting to see OpenSIPS publish advisories even for niche
modules, while Kamailio keeps
many of its modules out of its security process.
- Critical,
enum: stack overflow from a
long R-URI user (GHSA-x5hj-r293-vpw4).
- Critical,
sip_i: heap overflow in the
ISUP parser (GHSA-qc7q-vrx3-3j4h).
- High,
mediaproxy and
sngtc: stack overflows from an oversized SDP
c= address (GHSA-ggff-j9pg-p572,
GHSA-6pjc-3x9r-mp8h).
- High,
pua: stack overflow from a long
SIP-ETag (GHSA-5w5j-xrr5-wr49).
- High,
xcap: global buffer overflow
from a long XCAP URI (GHSA-prfg-gmxf-8v59).
- High, multipart bodies: crash in
reassemble_body_parts(), master only (GHSA-wrjf-686w-4mvp).
- High,
xmpp: two buffer overflows from
long JIDs and SIP URIs (GHSA-5gm5-wj62-p234,
GHSA-hwv5-237j-jq7m).
- High,
domainpolicy: stack overflow
from a long R-URI host and port (GHSA-4vg3-hjjc-xv58).
- High,
proto_msrp: heap overflow from
reordered MSRP headers (GHSA-qj7m-hgmv-pfrv).
- High,
identity: stack corruption from
a short Identity header (GHSA-f7wm-6cwv-4q46).
- High,
proto_hep: memory leak per
compressed HEPv3 packet (GHSA-3w47-rhcp-gpw5).
- High,
rtpproxy: out-of-bounds read
from a long Call-ID (GHSA-qv9x-v8jq-434w).
- High,
b2b_entities: two buffer
overflows via Contact parameters, 4.0 only (GHSA-vq5g-56jm-839g,
GHSA-5fj6-58f4-75r3).
Răzvan Crainea wrote the fixes and published the advisories. Credited
reporters: Tristan Madani (Talence Security), Jace, tinkerFz (Tencent
Keen Security Lab), Bin Luo, Nikola Kojic (RAS-IT) and David Korczynski
(Ada Logics).
Short news
Daniel-Constantin Mierla changed the default
kamailio.cfg in master so a fresh install drops all SIP
until you define ACTIVE, WITH_AUTH or
WITH_IPAUTH, instead of routing traffic with no
authentication. ACTIVE came first, and a follow-up
commit the same evening added WITH_AUTH and
WITH_IPAUTH. Master only for now, no backport to 6.0 or
6.1.
Issabel’s /pbxapi REST API shipped with the same JWT
signing key on every install, so anyone can forge a token and run OS
commands through Asterisk (CVE-2026-89026).
Issabel’s fix
commit of 31 July says the key had already leaked and was used to
install malware. A 2018 attempt to randomise the key per install didn’t
work, because the value was fixed at package build time. Update
issabel-framework to 5.0.0-4 or 4.0.0-13, check for signs
of compromise and keep /pbxapi off the internet. Thanks to
Fred Posner for the pointer.
An open bug
report shows FreeSWITCH 1.11.2 and 1.11.3 answering an SDP-less
re-INVITE on an SRTP call with a plain RTP/AVP offer, even with
rtp_secure_media=mandatory. Whether media actually goes
unencrypted depends on the peer. No maintainer response yet.
Four medium advisories on 17 September, found by Anthropic using
Claude. None of the fixes are in a release yet (2.17 is still the
latest).
Ten more advisories on 17 and 29 September, none with CVEs. The ones
worth acting on:
- An ordinary UCP user can read the whole database, including password
hashes, via SQL injection (GHSA-3827-8r8q-362j,
sangomartapi 16.0.57 / 17.0.29).
- An ordinary UCP user gets RCE through AMI injection in a
call-forward number (GHSA-3hr3-9whj-655f,
framework 16.0.50 / 17.0.33).
- An outside caller who controls their Caller ID can plant stored XSS
in CEL Reports (GHSA-hq6g-xv43-3v87,
cel 16.0.21 / 17.0.3).
Pexip’s July security
bulletins, all reported by Oddmund Skogen and fixed in 38.2, 39.2,
40.1 and 41.0:
HP’s Poly PrivateConnect runs Pexip and has its
own advisory.
Jacob Greenway reports that Azure Communication Services can attach a
separate session to a Teams meeting using only its
serverCallId, which any participant can get. That session
keeps receiving audio and roster updates after the organiser removes the
attacker. It needs the lobby off. Reported to MSRC on 19 August with no
response beyond an automated reply, no CVE and no independent
confirmation yet (PoC).
A follow-up to August’s
Chrome 152 bullet.
Six advisories on 23 September, fixed in 1.4.2 and 0.16.2, none with
CVEs. This follows the 1.4.1
fixes we covered in May.
A high-severity SCTP advisory on 16 September (GHSA-rq7g-r9qr-rwpq):
any peer with an established association, such as a WebRTC data channel,
can crash the whole worker and every session on it. Fixed in 3.27.1
(Rust 0.28.1), or set enablePartialReliability to false.
It’s the third batch of mediasoup SCTP bugs since June, following the
ones we covered in June
and July.
GStreamer sits in a lot of RTC pipelines. Three recent advisories are
network-reachable denial of service:
- H.264 and H.265 RTP depayloaders don’t cap reassembled fragments, so
a sender can exhaust memory (CVE-2026-18649,
gst-plugins-good 1.28.6).
- RTP sessions create an entry for every new SSRC and CSRC with no
limit, so valid RTP alone can exhaust memory (SA-2026-0074,
gst-plugins-good 1.28.6).
- A crafted RTSP Authorization header crashes an RTSP server (CVE-2026-85150,
gst-plugins-base 1.28.7).
libsrtp v2.8.1
adds srtp_set_stream_require_cryptex() from Philipp Hancke,
so applications can reject packets whose header extensions arrive
unprotected. Until now, cryptex could be used but not enforced. We
covered cryptex landing in libsrtp in March
2025.
Two more advisories on 20 September, no CVEs, and no fix: 10.0.16,
the latest release, is affected. This follows our July
and August
coverage.
- High: one malformed packet relayed through a
turns: or stuns: ICE server permanently kills
the TURN relay path (GHSA-6848-qmp4-652w).
- Medium: an oversized Content-Length makes the
SIP-over-WebSocket client loop at 100% CPU (GHSA-j5j8-rhcm-7fp9).
SIPp 3.7.8 (23 September) fixes three buffer overflows reported by
Tristan Madani. A malicious peer can crash SIPp through 3.7.7 with:
SIPp is a test tool, so this matters for test rigs exposed to
untrusted SIP traffic.
A long Call-ID, X-Call-ID or Reason header overflows a stack buffer
in sngrep through 1.8.4, whether it comes from a pcap, live capture or
HEP (CVE-2026-90558).
It’s a different code path from the overflows we covered in April
2024. The fix
is on master, with no release yet.
Two Matrix advisories on 2 September, neither with a CVE:
- High, Continuwuity (homeserver): the password reset
flow emailed the reset link to an address the requester chose, so any
account with an email address could be taken over (GHSA-v2x6-m99h-vqxx).
Only servers with SMTP configured; fixed in 26.7.3.
- Low, Element Web and Desktop: some URL preview
links could run JavaScript, behind an experimental flag that is off by
default (GHSA-9r5h-8m2x-w7q6).
Fixed in 1.12.27.
Xusheng Li reverse
engineered how Zoom’s My Notes feature knows you’re on a Google
Meet, Teams or Slack call: it reads the macOS system log and a Windows
registry key that show which apps are using the microphone. Neither
needs microphone permission or elevated privileges, so any unprivileged
process can do the same.
Netskope reports
that a variant of the EtherHiding campaign on compromised websites now
fetches code over a WebRTC data channel. The C2’s connection details are
hardcoded in the script, so the browser connects straight to the
attacker over UDP with no signaling server or STUN/TURN. It follows TWINLOOT’s
use of Teams TURN servers in August. An HTTP proxy won’t see this
traffic.
An open source tool for getting around Russia’s whitelist censorship:
it tunnels internet traffic through the SFUs of approved Russian
video-calling services such as VK Call and Yandex Telemost, over a
WebRTC data channel or inside a VP8 video track. To DPI it looks like a
normal call. For the services it supports, anyone who can start a call
can repurpose the conferencing infrastructure as a relay. Via Tsahi
Levent-Levi’s WebRTC
Weekly.
Brent Bailey, who commits from a Twilio address, published a guide
(in a personal repo, not official Twilio docs) on securing the
wss:// endpoints behind ConversationRelay and Media
Streams. By default anyone who finds the URL gets an anonymous channel
into your voice AI agent. The fix: verify
X-Twilio-Signature on the upgrade request and add
short-lived, single-use tokens bound to the call. One gotcha: Twilio
signs the WebSocket (wss) form of the URL, not the
https one.
Since 11 September, manufacturers selling products with digital
elements in the EU must report
actively exploited vulnerabilities and severe incidents: an early
warning within 24 hours, a notification within 72 hours, and a final
report later. They must also tell affected users what to do. That
includes IP PBX, SBC, phone and conferencing vendors. Switchvox’s
“banner after login” notification this month is the kind of practice the
CRA is aimed at.
Robert Hess and Alexander Müller are running a one-day WebRTC network
analysis masterclass on 2 November in Brussels, before SharkFest’26
EUROPE. It works through real captures (signaling, ICE/STUN/TURN, media)
and covers what breaks WebRTC in enterprise networks and how Teams,
Zoom, Webex and Meet differ. Attendees can bring their own captures.
