FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY
FreeSWITCH legs that negotiate ICE, including WebRTC via mod_verto or mod_sofia over WS/WSS and SIP peers that offer ICE, are exposed. Fixed in 1.11.2.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 1.11.2
- Who is exposed
- Default setups
Do first: Check every install: default setups are affected.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 31/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Default setups
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
FreeSWITCH, a Software Defined Telecom Stack, accepts forged ICE connectivity checks without verifying their STUN MESSAGE-INTEGRITY, so a remote attacker who can reach an ICE-enabled media port can redirect RTP and DTLS traffic to their own address and terminate the legitimate media path, all without logging in. On unencrypted legs, the attacker can also eavesdrop on and inject media.
Read the original description
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, FreeSWITCH's inbound ICE handling accepted every connectivity check without cryptographically validating its STUN MESSAGE-INTEGRITY attribute. A network peer able to reach an ICE-enabled leg's media port could forge an ICE connectivity check without SDP credentials, nominate its own address, redirect RTP and DTLS traffic, and terminate the legitimate media path. On unencrypted legs this enables eavesdropping and media injection, while all WebRTC and SIP legs that negotiate ICE are in scope. Version 1.11.2 introduces the remediation, which requires ice_verify_message_integrity=true.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure22/25Default setups, reachable over the network without a login
- Reach?/20Unknown. No tracked technology or package matched
- Severity9.1/10CVSS 9.1
- No patch0/5No signal
What would change the score
- Would score about 71 if added to CISA KEV
- Would score about 66 if CISA's SSVC rates exploitation active
What to do
Check every install: default setups are affected.
Upgrade to a fixed version: 1.11.2.
Workaround: Restrict the media port range to sources reachable only over trusted transports (firewall, SBC, private interconnect).
Timeline
- CVE published
- First seen by cve.now1 day
- Posted on X by cve.now
Affected versions
- signalwire freeswitch
fixed in 1.11.2
Evidence 3
- Advisory
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-116790
Is CVE-2026-116790 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
FreeSWITCH accepts inbound ICE connectivity checks without verifying the STUN MESSAGE-INTEGRITY attribute. An attacker can redirect a leg's media to their own address, ending the legitimate media path. Where no media encryption is negotiated, the redirected stream is plaintext, which allows eavesdropping and injection.Source: github.com
Which versions are affected by CVE-2026-116790?
freeswitch: before 1.11.2.Source: cve.now feed data
Am I affected, and how do I check?
Affected are FreeSWITCH legs that negotiate ICE, namely WebRTC through mod_verto or mod_sofia over WS/WSS and SIP peers that offer ICE. The vendor's fixed release is 1.11.2, so check the installed version with fs_cli -x version to see which side of that line a system is on.Source: github.com
How do I fix CVE-2026-116790?
Upgrade FreeSWITCH to 1.11.2 or later. Verification of ICE message integrity is opt-in and off by default, so setting the ice_verify_message_integrity channel variable is needed to close the gap.Source: github.com