coturn up to 4.7.0-r4 on Windows random weak prng

Summaryinfo

A vulnerability has been found in coturn up to 4.7.0-r4 on Windows and classified as problematic. This issue affects the function random. The manipulation leads to weak prng. This vulnerability is referenced as CVE-2025-69217. Remote exploitation of the attack is possible. No exploit is available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in coturn up to 4.7.0-r4 on Windows. It has been rated as problematic. This issue affects the function random. The manipulation with an unknown input leads to a weak prng vulnerability. Using CWE to declare the problem leads to CWE-338. The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong. Impacted is confidentiality. The summary by CVE is:

coturn is a free open source implementation of TURN and STUN Server. Versions 4.6.2r5 through 4.7.0-r4 have a bad random number generator for nonces and port randomization after refactoring. Additionally, random numbers aren't generated with openssl's RAND_bytes but libc's random() (if it's not running on Windows). When fetching about 50 sequential nonces (i.e., through sending 50 unauthenticated allocations requests) it is possible to completely reconstruct the current state of the random number generator, thereby predicting the next nonce. This allows authentication while spoofing IPs. An attacker can send authenticated messages without ever receiving the responses, including the nonce (requires knowledge of the credentials, which is e.g., often the case in IoT settings). Since the port randomization is deterministic given the pseudorandom seed, an attacker can exactly reconstruct the ports and, hence predict the randomization of the ports. If an attacker allocates a relay port, they know the current port, and they are able to predict the next relay port (at least if it is not used before). Commit 11fc465f4bba70bb0ad8aae17d6c4a63a29917d9 contains a fix.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2025-69217 since 12/29/2025. The exploitation is known to be difficult. The attack may be initiated remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1600.001 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 281680 (Linux Distros Unpatched Vulnerability : CVE-2025-69217), which helps to determine the existence of the flaw in a target environment.

Applying the patch 11fc465f4bba70bb0ad8aae17d6c4a63a29917d9 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the databases at CNNVD (CNNVD-202512-5486), Tenable (281680) and EUVD (EUVD-2025-205680). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• coturn

Version

• 4.7.0-r4

License

• open-source

Website

• Product: https://github.com/coturn/coturn/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion