CVE-2021-41105 : What You Need to Know

FreeSWITCH prior to version 1.10.7 is susceptible to a Denial of Service (DoS) vulnerability when handling SRTP calls, allowing attackers to terminate calls. Learn more about this security issue and how to mitigate it.

Understanding CVE-2021-41105

FreeSWITCH is a Software Defined Telecom Stack that enables the transition from proprietary telecom switches to software solutions. The vulnerability in versions prior to 1.10.7 allows remote attackers to disrupt encrypted calls.

What is CVE-2021-41105?

Occurs in FreeSWITCH versions earlier than 1.10.7
Vulnerability lies in handling SRTP calls
Attackers can terminate calls by flooding media ports with crafted SRTP packets

The Impact of CVE-2021-41105

CVSS Base Score: 7.5 (High)
Attack Vector: Network
Availability Impact: High
Users can face continuous call disruptions and denial of service

Technical Details of CVE-2021-41105

FreeSWITCH vulnerability explanation and affected systems.

Vulnerability Description

Calls can be terminated by remote attackers
SRTP packet flooding causes denial of service
Issue located in line 6331 of

switch_rtp.c

Affected Systems and Versions

Product: FreeSWITCH
Vendor: SignalWire
Versions affected: < 1.10.7

Exploitation Mechanism

Vulnerability exploited by flooding media ports with crafted SRTP packets

Mitigation and Prevention

Protecting systems against CVE-2021-41105.

Immediate Steps to Take

Update FreeSWITCH to version 1.10.7
Monitor network traffic for suspicious activity

Long-Term Security Practices

Implement strong network segmentation
Conduct regular security assessments

Patching and Updates

The issue is patched in version 1.10.7