CVE-2026-116790 in FreeSWITCH
Summary
by MITRE • 11/05/2026
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, FreeSWITCH's inbound ICE handling accepted every connectivity check without cryptographically validating its STUN MESSAGE-INTEGRITY attribute. A network peer able to reach an ICE-enabled leg's media port could forge an ICE connectivity check without SDP credentials, nominate its own address, redirect RTP and DTLS traffic, and terminate the legitimate media path. On unencrypted legs this enables eavesdropping and media injection, while all WebRTC and SIP legs that negotiate ICE are in scope. Version 1.11.2 introduces the remediation, which requires ice_verify_message_integrity=true.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
FreeSWITCH serves as a critical software-defined telecom stack designed to facilitate the migration from proprietary hardware switches to flexible software implementations running on commodity hardware. Within this architecture, Interactive Connectivity Establishment (ICE) plays a pivotal role in negotiating network paths for real-time media streams such as RTP and DTLS. Prior to version 1.11.2, FreeSWITCH exhibited a significant security flaw in its handling of inbound ICE connectivity checks. The vulnerability stemmed from the system's failure to cryptographically validate the STUN MESSAGE-INTEGRITY attribute during these negotiations. This oversight meant that any network peer capable of reaching an ICE-enabled leg's media port could interact with the signaling process without possessing valid Session Description Protocol credentials, effectively bypassing authentication mechanisms intended to secure the connection setup phase.
The technical flaw allows a malicious actor to forge ICE connectivity checks by omitting or manipulating integrity verification steps. By exploiting this weakness, an attacker can nominate their own network address as the preferred path for media traffic. This action results in the redirection of RTP and DTLS streams away from the legitimate participants toward infrastructure controlled by the adversary. The operational impact is severe, particularly on unencrypted legs where eavesdropping becomes trivial, allowing attackers to intercept sensitive audio or video communications. Furthermore, the ability to inject malicious media into these redirected streams poses a direct threat to user safety and data integrity. This vulnerability affects all WebRTC and SIP legs that negotiate ICE connections, making it a widespread risk for deployments relying on standard VoIP protocols over public networks.
From an industry standards perspective, this flaw aligns with CWE-287, which describes Improper Authentication, as the system failed to verify the identity of the peer attempting to establish media paths. It also relates to CWE-345, Insufficient Verification of Data Authenticity, due to the lack of cryptographic validation on STUN messages. In terms of attack vectors, this vulnerability facilitates MITM (Man-in-the-Middle) attacks and is consistent with ATT&CK techniques such as T1076, Remote Video Conference Hijacking, where an attacker inserts themselves into a communication session to monitor or disrupt it. The absence of integrity checks on signaling messages allows the attacker to manipulate routing decisions without detection by standard security controls that rely solely on network-level access restrictions.
The remediation for this vulnerability was introduced in FreeSWITCH version 1.11.2 through the implementation of mandatory message integrity verification. Administrators must ensure that the configuration parameter ice_verify_message_integrity is set to true. This setting enforces cryptographic validation of STUN MESSAGE-INTEGRITY attributes, ensuring that only peers with valid credentials can successfully negotiate media paths. Organizations running older versions should prioritize upgrading immediately or applying this specific configuration change if an upgrade is not feasible in the short term. Additionally, implementing network-level access controls and monitoring for anomalous ICE negotiation patterns can provide defense-in-depth measures against exploitation attempts while patching efforts are underway.