CVE-2025-53399
MediumCVSS 6.9Exploitation Probability (EPSS)
Very high risk91th percentile - higher than 91% of all known CVEs
Summary
In Sipwise rtpengine before version 13.4.1.1, an origin-validation error in the endpoint-learning logic of the media-relay core allows remote attackers to inject or intercept RTP/SRTP media streams via RTP packets, except when the relay is configured for strict source and learning disabled.
Risk Assessment
The organization is at risk of real-time audio/video stream eavesdropping or tampering, potentially leading to sensitive data leakage or communication integrity compromise.
Recommendation
Immediately upgrade Sipwise rtpengine to version 13.4.1.1 or later. Enable strict source mode and the recrypt flag in the configuration to fully mitigate SRTP attacks.
Original NVD description (English source)
In Sipwise rtpengine before 13.4.1.1, an origin-validation error in the endpoint-learning logic of the media-relay core allows remote attackers to inject or intercept RTP/SRTP media streams via RTP packets (except when the relay is configured for strict source and learning disabled). Version 13.4.1.1 fixes the heuristic mode by limiting exposure to the first five packets, and introduces a recrypt flag that fully prevents SRTP attacks when both mitigations are enabled.