CVE-2025-53399
CVSS Score
0.0
EPSS Score
5.0%
EPSS Percentile
91th
In Sipwise rtpengine before 13.4.1.1, an origin-validation error in the endpoint-learning logic of the media-relay core allows remote attackers to inject or intercept RTP/SRTP media streams via RTP packets (except when the relay is configured for strict source and learning disabled). Version 13.4.1.1 fixes the heuristic mode by limiting exposure to the first five packets, and introduces a recrypt flag that fully prevents SRTP attacks when both mitigations are enabled.
| CWE | CWE-346 |
| Vendor | sipwise |
| Product | rtpengine |
| Published | Aug 1, 2025 |
| Last Updated | Jul 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for sipwise rtpengine
Be the first to know when new unknown vulnerabilities affecting sipwise rtpengine are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Sipwise / rtpengine
0 < 13.4.1.1
References
github.com: https://github.com/sipwise/rtpengine/commits/rfuchs/security/ openwall.com: https://www.openwall.com/lists/oss-security/2025/07/31/1 github.com: https://github.com/sipwise/rtpengine/releases/tag/mr13.4.1.1 github.com: https://github.com/EnableSecurity/advisories/tree/master/ES2025-01-rtpengine-improper-behavior-bleed-inject seclists.org: http://seclists.org/fulldisclosure/2025/Aug/1 openwall.com: http://www.openwall.com/lists/oss-security/2025/07/31/1 lists.debian.org: https://lists.debian.org/debian-lts-announce/2026/07/msg00033.html