CVE-2023-51443

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.10.11, when handling DTLS-SRTP for media setup, FreeSWITCH is susceptible to Denial of Service due to a race condition in the hello handshake phase of the DTLS protocol. This attack can be done continuously, thus denying new DTLS-SRTP encrypted calls during the attack. If an attacker manages to send a ClientHello DTLS message with an invalid CipherSuite (such as `TLS_NULL_WITH_NULL_NULL`) to the port on the FreeSWITCH server that is expecting packets from the caller, a DTLS error is generated. This results in the media session being torn down, which is followed by teardown at signaling (SIP) level too. Abuse of this vulnerability may lead to a massive Denial of Service on vulnerable FreeSWITCH servers for calls that rely on DTLS-SRTP. To address this vulnerability, upgrade FreeSWITCH to 1.10.11 which includes the security fix. The solution implemented is to drop all packets from addresses that have not been validated by an ICE check.

• CWE-703

• http://packetstormsecurity.com/files/176393/FreeSWITCH-Denial-Of-Service.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/signalwire/freeswitch/commit/86cbda90b84ba186e508fbc7bfae469270a97d11Patch
• https://github.com/signalwire/freeswitch/security/advisories/GHSA-39gv-hq72-j6m6Exploit, Vendor Advisory
• http://packetstormsecurity.com/files/176311/FreeSWITCH-1.10.10-Denial-Of-Service.html
• http://packetstormsecurity.com/files/176393/FreeSWITCH-Denial-Of-Service.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2023/Dec/29
• https://github.com/signalwire/freeswitch/commit/86cbda90b84ba186e508fbc7bfae469270a97d11Patch
• https://github.com/signalwire/freeswitch/security/advisories/GHSA-39gv-hq72-j6m6Exploit, Vendor Advisory

Published

Dec 27, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-51438A vulnerability has been identified in SIMATIC IPC1047E (All…9.8
• CVE-2023-51439A vulnerability has been identified in JT2Go (All versions <…7.8
• CVE-2023-5144** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was c…8.8
• CVE-2023-51440A vulnerability has been identified in SIMATIC CP 343-1 (6GK…7.5
• CVE-2023-51441** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vu…7.2
• CVE-2023-51442Navidrome is an open source web-based music collection serve…8.6
• CVE-2023-51444GeoServer is an open source software server written in Java …7.2
• CVE-2023-51445GeoServer is an open source software server written in Java …4.8
• CVE-2023-51446GLPI is a Free Asset and IT Management Software package. Whe…8.1
• CVE-2023-51447Decidim is a participatory democracy framework. Starting in …5.4
• CVE-2023-51448Cacti provides an operational monitoring and fault managemen…8.8
• CVE-2023-51449Gradio is an open-source Python package that allows you to q…7.5