We talk about Offensive Real-Time Communications / VoIP and WebRTC Security Blog: https://xitter.cf/t.co/1AUEmQhlOH Newsletter: https://xitter.cf/t.co/Mzul797kHv
Germany
Joined May 2016
- Tweets305
- Following178
- Followers365
- Likes173
New advisory ES2026-06: password reset authentication bypass in Enswitch. If an account had no pending reset, anyone who knew the username could set a new password with no reset key. Abused in the wild before disclosure. Fixes are available.
enablesecurity.com/blog/ensw…
Integrics acknowledged our report and supplied fixes the same day, and shipped them to customers three days later. We tested the 4.4 fix and it closes both issues.
Fixed: 3.13 to 4.3 at SVN r21680+, 4.4 at Git c2c981578+.
3/ OpenSIPS published 16 advisories this month, fixed by @razvancrainea and reported by @TristanInSec, @davkorcz and others. Most advisories in this edition came without a CVE ID, and we look at why.
4/ Short news: @miconda's secure-by-default Kamailio config, @HCornflower's cryptex enforcement in libsrtp, @jacobgreenway's Teams audio report, and a WebRTC censorship tunnel spotted in @tsahil's WebRTC Weekly.
5/ Plus our coturn guide refresh, why Kamailio's IMS bugs don't get advisories, and Issabel under attack.
Read it:
enablesecurity.com/newslette…
#VoIP #WebRTC #InfoSec #RTCSec
2/ WeWorm: @XorNinja's team at Calif showed a zero-click bug in WeChat's VoIP stack that takes over an account while the phone is still ringing. Serious finding. We go through the caveats most of the coverage left out.
1/ Sangoma Switchvox is being exploited in the wild through CVE-2026-9586, the unauthenticated SQL injection fixed in 8.4.0.2 back in July. @hacks_zach's team at Horizon3 caught it in their honeypots. Upgrading doesn't clean a compromised box.
September RTCSec newsletter 🧵
August RTCSec newsletter: FreeSWITCH RCE exploited in the wild via api-chat, upgrade to 1.11.3. Plus what we found reproducing coturn's August advisory batch, and the RTC and telecom research out of Hacker Summer Camp.
enablesecurity.com/newslette…
1/ AI-generated vulnerability reports are burying open source projects. This month we did something about one of them: we took 0day Rubbish's AI-found, self-published RCE chains and actually ran them.
July RTCSec newsletter 🧵
4/ Also this month: @oej's hand-built operational SBOM for Kamailio, FreePBX's two unauthenticated criticals (Caller ID SQL injection + UCP RCE), and a batch of WebRTC memory-safety fixes across Chrome, Firefox and Apple.
5/ Read the full July edition:
enablesecurity.com/newslette…
1/ DragonForce ransomware now tunnels its C2 through Microsoft Teams TURN relays. Symantec calls it the first publicly documented case of a threat actor abusing TURN for C2. On the wire it looks like a normal Teams call, slipping past perimeters that safelist Microsoft.
3/ coturn shipped new hardening defaults (4.13.1/4.14.0, including a native amplification rate limit) plus three more CVEs, including a default loopback bypass (CVE-2026-53450). We refreshed our coturn security configuration guide to match.
4/ Also this month: FRAFOS caught toll fraud through 231 misconfigured Cisco Expressways, a big FreeSWITCH advisory batch (pre-auth mod_verto heap overflow), and our CommCon talk on attacking WebRTC conferencing.
Full issue: enablesecurity.com/newslette…