Description

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, FreeSWITCH's inbound ICE handling accepted every connectivity check without cryptographically validating its STUN MESSAGE-INTEGRITY attribute. A network peer able to reach an ICE-enabled leg's media port could forge an ICE connectivity check without SDP credentials, nominate its own address, redirect RTP and DTLS traffic, and terminate the legitimate media path. On unencrypted legs this enables eavesdropping and media injection, while all WebRTC and SIP legs that negotiate ICE are in scope. Version 1.11.2 introduces the remediation, which requires ice_verify_message_integrity=true.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-11-05T20:17:46.557Z",
  "pubdate": "2026-11-05T20:17:46.557Z",
  "executiveSummary": "FreeSWITCH versions prior to 1.11.2 contain a critical vulnerability in the handling of inbound ICE (Interactive Connectivity Establishment) connectivity checks.\nThe vulnerability stems from the absence of cryptographic validation for the STUN MESSAGE-INTEGRITY attribute during the ICE negotiation process.\nBy failing to verify the integrity of these messages, the system is susceptible to unauthorized peer redirection, enabling an attacker to hijack media streams.\nThis impacts both unencrypted RTP traffic and secure WebRTC/SIP sessions that rely on ICE for NAT traversal and path establishment.\nAn unauthenticated attacker with network access to the media port can forge connectivity checks, nominate malicious addresses, and successfully perform man-in-the-middle (MITM) attacks.\nThe exploitation allows for the interception of sensitive communications, unauthorized media injection, and the termination of legitimate media paths, effectively compromising the confidentiality and availability of the telecom service.",
  "technicalDetails": "The vulnerability resides within the FreeSWITCH inbound ICE handling mechanism, which is responsible for processing STUN packets used to establish media paths between peers.\nThe root cause is a deficiency in the ICE implementation: the system accepts connectivity checks from network peers without performing mandatory cryptographic verification of the STUN MESSAGE-INTEGRITY attribute.\nUnder the ICE protocol, the MESSAGE-INTEGRITY attribute is essential to confirm that the STUN message originated from an entity possessing the correct credentials (username and password) shared via SDP.\nBy omitting this verification, FreeSWITCH blindly accepts connectivity checks from any source that can reach the target media port.\nThe attack flow proceeds as follows: 1) An attacker identifies a target FreeSWITCH instance utilizing ICE for media negotiation. 2) The attacker transmits a crafted STUN connectivity check packet to the target's media port. 3) Because the target fails to validate the MESSAGE-INTEGRITY attribute, it interprets the attacker's forged packet as a legitimate ICE nomination. 4) The FreeSWITCH stack updates its internal state to reflect the attacker's address as the valid remote candidate. 5) Subsequent RTP or DTLS media traffic is redirected to the attacker-controlled address.\nThis results in the attacker gaining full control over the media path, allowing for eavesdropping on unencrypted RTP streams or the injection of malicious media content into the session.\nFor encrypted legs such as WebRTC or secure SIP, this vulnerability undermines the security architecture by allowing the attacker to position themselves as a transparent relay or terminator, potentially leading to a breakdown in end-to-end security if the attacker facilitates the handshake while intercepting the underlying transport.\nNo authentication or specific privileges are required; the attacker merely needs network reachability to the media port. This vulnerability affects all FreeSWITCH versions prior to 1.11.2 where ICE is enabled."
}