Security readout for executives and security teams
Plain-English summary
This flaw affects Sipwise rtpengine media relays before 13.4.1.1. A remote attacker may be able to inject or intercept voice/media traffic by abusing how the relay learns packet endpoints. Business impact is mainly confidentiality and integrity of communications, plus limited availability impact.
Executive priority
Treat this as a moderate-priority communications security issue. Patch exposed or sensitive rtpengine deployments promptly, especially where voice or media confidentiality matters. Escalate priority if the relay is internet-facing or serves regulated, executive, or customer communications.
Technical view
CVE-2025-53399 is a CWE-346 origin-validation issue in rtpengine endpoint-learning logic. The published CVSS 4.0 score is 6.9. The issue affects versions before 13.4.1.1 unless strict source is configured and learning is disabled. The fix limits heuristic exposure to the first five packets and adds SRTP recrypt protection when enabled.
Likely exposure
Exposure is most likely where Sipwise rtpengine before 13.4.1.1 relays RTP or SRTP traffic and endpoint learning or heuristic behavior is enabled. Systems using strict source with learning disabled are described as outside the vulnerable condition.
Exploitation context
The CVE describes remote, unauthenticated network attack potential with low complexity. KEV is false in the supplied data, and the bundle does not provide evidence of active exploitation. Do not treat this as exploited in the wild without additional sourcing.
Researcher notes
The supplied record names rtpengine before 13.4.1.1 and gives narrow configuration exceptions. It does not include full affected-version ranges beyond that threshold, proof-of-concept status, or confirmed exploitation. Analysis should stay tied to version checks and configuration review.
Mitigation direction
- Upgrade Sipwise rtpengine to version 13.4.1.1 or a fixed distributor package.
- Use strict source with endpoint learning disabled where operationally compatible.
- For SRTP, enable the new recrypt flag when available and appropriate.
- Review Sipwise, EnableSecurity, and distribution advisories for deployment-specific guidance.
- Prioritize exposed media relay nodes handling sensitive or high-volume communications.
Validation and detection
- Inventory all rtpengine instances and record exact installed versions.
- Check whether endpoint learning or heuristic endpoint handling is enabled.
- Confirm strict source behavior is configured where intended.
- For SRTP deployments, verify whether recrypt support is present and enabled.
- Review media relay logs for unexpected source changes or stream anomalies.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-346: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-53399 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.9 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:L/SA:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:L/SA:L——mitreVulnerability scoring details
Base CVSS 4.0 score
6.9MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:L/SA:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/sipwise/rtpengine/commits/rfuchs/security/CVE reference, mitre
- https://www.openwall.com/lists/oss-security/2025/07/31/1CVE reference, mitre
- https://github.com/sipwise/rtpengine/releases/tag/mr13.4.1.1CVE reference, mitre
- https://github.com/EnableSecurity/advisories/tree/master/ES2025-01-rtpengine-improper-behavior-bleed-injectCVE reference, mitre
- https://lists.debian.org/debian-lts-announce/2026/07/msg00033.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Origin Validation Error
Origin Validation Error represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.