CVE-2025-53399: CWE-346 Origin Validation Error in Sipwise rtpengine
In Sipwise rtpengine before 13.4.1.1, an origin-validation error in the endpoint-learning logic of the media-relay core allows remote attackers to inject or intercept RTP/SRTP media streams via RTP packets (except when the relay is configured for strict source and learning disabled). Version 13.4.1.1 fixes the heuristic mode by limiting exposure to the first five packets, and introduces a recrypt flag that fully prevents SRTP attacks when both mitigations are enabled.
AI Analysis
Technical Summary
Sipwise rtpengine before version 13.4.1.1 contains a CWE-346 origin validation error in its endpoint-learning logic within the media-relay core. This vulnerability allows remote attackers to inject or intercept RTP and SRTP media streams by sending crafted RTP packets. The vulnerability is not exploitable if the relay is configured with strict source checking and learning disabled. The fixed version 13.4.1.1 improves the heuristic mode by limiting exposure to the first five packets and introduces a recrypt flag that, when enabled alongside the heuristic limit, fully prevents SRTP attacks.
Potential Impact
Remote attackers can exploit this vulnerability to inject or intercept RTP and SRTP media streams, potentially compromising the confidentiality and integrity of media communications. The impact is limited if strict source configuration and learning disablement are in place. The CVSS 4.0 base score is 6.9 (medium severity), indicating a significant but not critical risk.
Mitigation Recommendations
Upgrade to Sipwise rtpengine version 13.4.1.1 or later, which fixes the vulnerability by limiting heuristic exposure and adding a recrypt flag to prevent SRTP attacks. Alternatively, configure the relay for strict source checking and disable learning to mitigate the risk. Patch status is not explicitly confirmed in the input data, but the vendor has released version 13.4.1.1 with fixes, so applying this update is the recommended remediation.
CVE-2025-53399: CWE-346 Origin Validation Error in Sipwise rtpengine
Description
In Sipwise rtpengine before 13.4.1.1, an origin-validation error in the endpoint-learning logic of the media-relay core allows remote attackers to inject or intercept RTP/SRTP media streams via RTP packets (except when the relay is configured for strict source and learning disabled). Version 13.4.1.1 fixes the heuristic mode by limiting exposure to the first five packets, and introduces a recrypt flag that fully prevents SRTP attacks when both mitigations are enabled.
CVSS v4.0
Score 6.9medium
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Sipwise rtpengine before version 13.4.1.1 contains a CWE-346 origin validation error in its endpoint-learning logic within the media-relay core. This vulnerability allows remote attackers to inject or intercept RTP and SRTP media streams by sending crafted RTP packets. The vulnerability is not exploitable if the relay is configured with strict source checking and learning disabled. The fixed version 13.4.1.1 improves the heuristic mode by limiting exposure to the first five packets and introduces a recrypt flag that, when enabled alongside the heuristic limit, fully prevents SRTP attacks.
Potential Impact
Remote attackers can exploit this vulnerability to inject or intercept RTP and SRTP media streams, potentially compromising the confidentiality and integrity of media communications. The impact is limited if strict source configuration and learning disablement are in place. The CVSS 4.0 base score is 6.9 (medium severity), indicating a significant but not critical risk.
Mitigation Recommendations
Upgrade to Sipwise rtpengine version 13.4.1.1 or later, which fixes the vulnerability by limiting heuristic exposure and adding a recrypt flag to prevent SRTP attacks. Alternatively, configure the relay for strict source checking and disable learning to mitigate the risk. Patch status is not explicitly confirmed in the input data, but the vendor has released version 13.4.1.1 with fixes, so applying this update is the recommended remediation.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- mitre
- Date Reserved
- 2025-06-29T00:00:00.000Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 688c355dad5a09ad00bf552d
Added to database: 08/01/2025, 03:32:45 UTC
Last enriched: 07/21/2026, 20:08:57 UTC
Last updated: 09/10/2026, 19:36:51 UTC
Views: 290
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.