Summary FreeSWITCH signs the STUN connectivity checks and responses it sends with the ICE password, but never verifies the MESSAGE-INTEGRITY attribute on the ones it receives: the core STUN parser only length-checks it, and the inbound ICE handling in `src/switch_rtp.c` drives the ICE state machine from the packet's attributes without recomputing or comparing the HMAC. Any STUN packet delivered to the media port of an ICE-enabled call leg is treated as authentic, with a wrong MESSAGE-INTEGRITY or none at all. RFC 8445 section 7.3 requires the short-term credential mechanism to authenticate both requests and responses. Impact ICE selects the media path entirely from Binding exchange outcomes, so a forged check decides it. A forged Binding Request re-points the leg's media destination at the sender's own address, marks the pair nominated, and can flip the controlling/controlled role: FreeSWITCH sends RTP and its DTLS handshake there instead of to the legitimate peer, ending media on the call. Where the leg negotiates no media encryption the redirected stream is plaintext, giving eavesdropping and injection. Affected configurations Any leg that negotiates ICE: WebRTC through `mod_verto` or `mod_sofia` over WS/WSS, and SIP peers that offer ICE. No non-default setting is required. Non-ICE SIP/RTP legs are out of scope, since the RTP read path only hands a datagram to the STUN parser once ICE credentials are installed on the session. Attack prerequisites Network reach to the negotiated UDP media port of an ICE-enabled leg while the call is up. Port discovery is a routine UDP scan of the configured RTP range. Because the packet is acted on without its integrity being checked, no account, no prior interaction, no position on the media path, and none of the ICE credentials carried in the SDP are required. Workarounds No in-process workaround: the ICE handler acts on any STUN-shaped datagram delivered to an ICE-enabled media socket. Operators who cannot upgrade should restrict the media port range to sources reachable only over trusted transports (firewall, SBC, private interconnect); a sender inside that perimeter is unaffected. Disabling ICE is not viable where WebRTC is served, since it requires ICE. Fix The same release adds `switch_stun_packet_verify_integrity()`, which recomputes the HMAC-SHA1 over the received packet and compares it in constant time, and calls it on the inbound ICE path before any ICE state is touched: requests keyed with the local ICE password, responses and error responses with the remote one. A packet whose MESSAGE-INTEGRITY fails or is missing is dropped, as is any unauthenticated indication. Verification is opt-in and off by default, so closing the gap means setting the `ice_verify_message_integrity` channel variable; `conf/vanilla/vars.xml` ships it as a commented example. Credit Xiangpu Song