Rtpengine: RTP Inject and RTP Bleed vulnerabilities despite proper configuration (CVSS v4.0 Score: 9.3 / Critical) Full Disclosure mailing list archives From: Sandro Gauci via Fulldisclosure Date: Thu, 31 Jul 2025 07:02:38 +0200 Rtpengine: RTP Inject and RTP Bleed vulnerabilities d ... Read more Published Date: Aug 03, 2025 (1 hour, 26 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2025-53399

July 2025 RTCSec newsletter: Rtpengine fixes, RTC conferences and showers of vulnerabilities

ProVoice packages build environment for Kamailio using Docker - ProVoice/provoice-build-kamailio

Security updates have been issued by **AlmaLinux** (389-ds-base, c-ares, dovecot, freerdp, glib2, gstreamer1-plugins-good, gstreamer1-plugins-ugly-free, hplip, kernel, kernel-rt, nodejs:22, perl-XML-LibXML, webkit2gtk3, and yggdrasil), **Debian** (kernel, nss, roundcube, rtpengine, and xz-utils), **Fedora** (btrbk, kernel, mupdf, nuclei, perl-Crypt-OpenSSL-X509, rust-fern, rust-ifcfg-devname, rust-routinator, rust-rpki, and rust-syslog), **Mageia** (tig), **Oracle** (.NET 10.0, .NET 8.0, .NET 9.0, acl, dovecot, glib2, httpd, libtiff, pacemaker, perl-IO-Compress, plexus-utils, python3, and webkit2gtk3), **Slackware** (libssh and mozilla-firefox), **SUSE** (acl, avahi, aws-nitro-enclaves-cli, beets, chromium, firefox, go1.25-openssl, ImageMagick, iscsiuio, kernel, kubevirt1.8-container-disk, libgit2-1_9, libkrun, libsoup-3_0-0, nghttp2, opam, php7, python-aiohttp, python-tornado6, and vim), and **Ubuntu** (accountsservice, CUPS, imagemagick, jbig2dec, openssh, and snapd).

Posted by Sandro Gauci on Jul 31 Rtpengine: RTP Inject and RTP Bleed vulnerabilities despite proper configuration (CVSS v4.0 Score: 9.3 / Critical) - CVSS v4.0 - Exploitability: High - Complexity: Low - Vulnerable system: Medium - Subsequent system: Medium - Exploitation: High - Security requirements: High - Vector: https://www.first.org/cvss/calculator/4-0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:H/SI:H/SA:H - Other references:...

Rtpengine's critical flaws (CVE-2025-53399, CVSS 9.3) allow attackers to intercept or inject audio into active VoIP calls, even without a MitM position, by exploiting SRTP validation.

Posted by Sandro Gauci via Fulldisclosure on Aug 02Rtpengine: RTP Inject and RTP Bleed vulnerabilities despite proper configuration (CVSS v4.0 Score: 9.3 / Critical) - CVSS v4.0 - Exploitability: High - Complexity: Low - Vulnerable system: Medium - Subsequent system: Medium - Exploitation: High - Security requirements: High - Vector: https://www.first.org/cvss/calculator/4-0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:H/SI:H/SA:H - Other references:...

DVRTC is an intentionally vulnerable lab designed to demonstrate VoIP and WebRTC attack techniques. It includes a full stack with Kamailio (SIP proxy), Asterisk (PBX), rtpengine (media), and coturn (TURN/STUN), each configured with specific vulnerabilities such as SIP enumeration, RTP bleed, TURN abuse, and weak credentials. The lab offers seven exercises with step-by-step instructions and provides a live instance at *pbx1.dvrtc.net* for testing. The author created it to address the lack of similar resources for VoIP/WebRTC security training.

Rtpengine's critical flaws (CVE-2025-53399, CVSS 9.3) allow attackers to intercept or inject audio into active VoIP calls, even without a MitM position, by exploiting SRTP validation.

Rtpengine vulnerabilities "RTP Inject" and "RTP Bleed" persist despite proper configuration, with a CVSS 4.0 score of 9.3 (critical). These attacks don't require the attacker as a middleman, and SRTP doesn't always prevent them. Thankfully, updates in version mr13.4.1.1 aim to patch these security holes, giving hackers a run for their RTP.