External risk intelligence

FreeSWITCH ICE Handling Vulnerability Allows Media Redirection and Eavesdropping

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-116790

FreeSWITCH is commonly deployed as an internet-facing gateway or media server for SIP and WebRTC communications. Because these services are designed to facilitate external connectivity and media traffic over the internet, they are frequently exposed to network peers, making the vulnerable ICE handling component a likely internet-accessible attack surface in real-world deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in FreeSWITCH, a software-defined telecommunications platform. The issue relates to how the system handles network connectivity checks, potentially allowing unauthorized parties to intercept or inject media traffic. This could impact the confidentiality and integrity of voice and video communications handled by affected systems.

Unvalidated network checks can disrupt communications.
It impacts secure and unencrypted media traffic.
Confirm relevance and exposure for business continuity.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network packets to a FreeSWITCH system that handles media traffic. By manipulating these packets, an attacker can trick the system into accepting them without proper validation, allowing them to redirect legitimate communication or inject their own audio. This could lead to eavesdropping on calls or inserting malicious audio into conversations.

Network access to media port required.
Unvalidated connectivity checks trigger.
Eavesdropping and media injection risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect the confidentiality and integrity of media traffic on FreeSWITCH deployments that support unencrypted legs, WebRTC, or SIP calls negotiating ICE. An unauthenticated network peer could potentially intercept or alter call content by forging connectivity checks, leading to eavesdropping or the injection of malicious media.

Call media streams.
Forging connectivity checks.
Eavesdropping and media injection.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in FreeSWITCH affects its inbound ICE handling, potentially allowing attackers to eavesdrop or inject media. Teams responsible for telecommunications infrastructure, voice/video platforms, and network security should collaborate on remediation. The first step is to identify all FreeSWITCH instances, confirm their exposure and criticality, and then plan mitigation based on risk.

Telecommunications and platform teams own the issue.
Verify network reachability and traffic redirection.
Plan remediation through configuration or patching.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FreeSWITCH?

FreeSWITCH is a software-defined telecommunications stack used to replace traditional hardware switches. It runs on commodity servers to manage voice, video, and data traffic, acting as a core engine for modern VoIP platforms, WebRTC applications, and SIP-based communication services.

How does CVE-2026-116790 affect communication integrity?

This vulnerability involves a failure to verify cryptographic signatures in ICE connectivity checks, categorized under CWE-290 and CWE-347. By skipping this check, the system can be tricked into trusting malicious network peers, allowing them to redirect media streams, eavesdrop on conversations, or inject unauthorized audio into active calls.

Does any specific network activity trigger this vulnerability?

The vulnerability is triggered when a remote network peer sends forged ICE connectivity checks directly to an active media port. It does not occur if the ICE protocol is disabled, nor can it be triggered without the ability to send network packets that reach the specific media ports used by the FreeSWITCH instance.

How do I know if my systems are at risk?

Halo Surface Signal indicates that FreeSWITCH is often deployed as an internet-facing gateway, making it a likely target. If your deployment uses ICE for SIP or WebRTC, it is exposed to potential external network peers, increasing the likelihood that this vulnerability is reachable from the internet.

What is the recommended first step for remediation?

Teams should first identify all running FreeSWITCH instances and determine if they utilize ICE. Once identified, prioritize updating to version 1.11.2 or later, which introduces the ability to enforce cryptographic verification by enabling the 'ice_verify_message_integrity' configuration setting.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.