Log in Start free

Vulnerability · Published Aug 1, 2025 · Assigned by mitre

CVE-2025-53399

Medium 6.9

In plain English

A medium-severity security flaw in rtpengine from Sipwise. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 7.2% (higher than 94% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)7.2%top 5.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

In Sipwise rtpengine before 13.4.1.1, an origin-validation error in the endpoint-learning logic of the media-relay core allows remote attackers to inject or intercept RTP/SRTP media streams via RTP packets (except when the relay is configured for strict source and learning disabled). Version 13.4.1.1 fixes the heuristic mode by limiting exposure to the first five packets, and introduces a recrypt flag that fully prevents SRTP attacks when both mitigations are enabled.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12rtpengine10.5.3.5-1+deb12u1DEBIAN-CVE-2025-53399
Debian:13rtpengineno fix listedDEBIAN-CVE-2025-53399
Debian:14rtpengine12.5.1.35-1DEBIAN-CVE-2025-53399
Ubuntu:24.04:LTSrtpengineno fix listedUBUNTU-CVE-2025-53399
Ubuntu:25.10rtpengineno fix listedUBUNTU-CVE-2025-53399
Ubuntu:26.04:LTSrtpengineno fix listedUBUNTU-CVE-2025-53399
Ubuntu:26.10rtpengineno fix listedUBUNTU-CVE-2025-53399

Affected products (as reported)

VendorProductVersions
Sipwise rtpengine 0 – before 13.4.1.1

Weakness: CWE-346 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:L/SA:L

References