PT-2025-31511 · Rtpengine+1 · Rtpengine+1

Sandro Gauci · Published 2025-07-31 · Updated 2025-08-01 · CVE-2025-53399

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions rtpengine versions through mr13.3.1.4

Description rtpengine is susceptible to RTP injection and media redirection, potentially leading to a denial-of-service (DoS) condition. RTP bleed allows an attacker to redirect a victim’s media, such as audio, to a host controlled by the attacker. RTP inject enables attackers to insert arbitrary RTP packets into active calls.

Recommendations Versions prior to mr13.3.2 should be updated.

Fix

DoS

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

CVE-2025-53399

Affected Products

Debian

Rtpengine

References · 21

• https://nvd.nist.gov/vuln/detail/CVE-2025-53399 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-53399 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-53399 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-53399 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-53399 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53399 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-53399 · Vendor Advisory
• https://github.com/sipwise/rtpengine/releases/tag/mr13.4.1.1 · Note
• https://github.com/EnableSecurity/advisories/tree/master/ES2025-01-rtpengine-improper-behavior-bleed-inject · Note
• http://openwall.com/lists/oss-security/2025/07/31/1 · Note
• https://twitter.com/samilaiho/status/1951155780033327352 · Twitter Post
• https://twitter.com/pepeluxx/status/1950823598874095993 · Twitter Post
• https://openwall.com/lists/oss-security/2025/07/31/1 · Note
• https://t.me/pentestingnews/65506 · Telegram Post
• https://twitter.com/fridaysecurity/status/1950845223095152992 · Twitter Post