VoIP and WebRTC
Security Articles and News
Articles and security news about vulnerabilities and attacks affecting VoIP and WebRTC by Enable Security.
Subscribe
Enswitch password reset bypass advisory
Published on Oct 1, 2026 in voip security, research, security advisory, enswitch, sip security
We published a security advisory for Enswitch covering CVE-2026-107640, an authentication bypass in the password reset API. An unauthenticated attacker who knew a username could set the account password without a valid reset key, and the same endpoint also leaked whether a username existed. The issue was abused in the wild before public disclosure. Integrics had a fix the same day we reported it and released it to customers three days later.…
DVRTC v0.2.0: pbx2 and SIP SQL injection
Published on Apr 21, 2026 in DVRTC, voip security, webrtc security, training, sip security, opensips, freeswitch, demo server, security tools
DVRTC v0.2.0 expands the lab with pbx2, a new OpenSIPS, FreeSWITCH, and rtpproxy scenario. It also adds a fun SIP-driven Lua SQL injection exercise, along with new docs, workflows, and attack paths to try.…
SIPVicious tutorial: testing VoIP security with DVRTC
Published on Apr 13, 2026 in sipvicious oss, security tools, sip security, voip security, DVRTC, demo server, kamailio, asterisk, training
A hands-on tutorial showing how to use SIPVicious OSS to scan, enumerate, and crack SIP credentials on our DVRTC vulnerable lab at pbx1.dvrtc.net. This is an updated version of our 2020 tutorial that used the now-retired demo.sipvicious.pro server.…
AI is coming for your C code and it does not need coffee
Published on Apr 3, 2026 in research, voip security, webrtc security
Thomas Ptacek argued last week that AI has fundamentally changed the economics of vulnerability research. We’ve run our own experiments and seen similar results. Here’s what this means specifically for RTC codebases - and for the humans who secure them.…
Introducing DVRTC: a vulnerable lab for RTC security
Published on Mar 27, 2026 in webrtc security, voip security, training, sip security, kamailio, asterisk, coturn, rtpengine, demo server, TURN security, DVRTC
We’re releasing DVRTC (Damn Vulnerable Real-Time Communications), an intentionally vulnerable VoIP/WebRTC lab environment for security training and research. It comes with 7 hands-on exercises covering 12 attack paths, a live deployment at pbx1.dvrtc.net, and everything you need to start practicing RTC security testing.…
TURN Server Security Best Practices
Published on Feb 25, 2026 in TURN security, server hardening, webrtc security
Implementation-agnostic security reference for TURN server deployments. Covers network isolation, access control rules, protocol hardening, rate limiting, and monitoring with a complete checklist, IP range reference tables, and deployment patterns.…
Securing coturn: Configuration Guide
Published on Feb 25, 2026 · Updated on Sep 29, 2026 in TURN security, coturn, server hardening, webrtc security
The coturn-specific companion to our TURN Server Security Best Practices guide. Copy-paste configuration blocks for access control, protocol hardening, rate limiting, and authentication, with three complete templates from minimal to high-security.…
TURN Security Threats: A Hacker’s View
Published on Feb 12, 2026 · Updated on Feb 25, 2026 in TURN security, webrtc security, server hardening
TURN servers are meant to relay media traffic for WebRTC, but they’re also powerful proxies that hackers have been abusing since at least 2017. We break down three critical threat categories: relay abuse, Denial of Service, and software vulnerabilities, with real-world examples from our research and pentesting.…
VoIP Eavesdropping: How it Works, Threats & Defense Tactics
Published on Oct 9, 2025 in voip security, sip security, webrtc security
VoIP eavesdropping is a critical security threat that can expose sensitive business and personal information. This comprehensive guide explains how attackers exploit VoIP vulnerabilities through packet sniffing, MITM attacks, and RTP Bleed, and provides actionable defense tactics including transport encryption, authentication, security audits, and network segmentation to protect your organization.…
Sandro talks RTC Security with Safety Detectives
Published on Aug 6, 2025 in voip security, denial of service
Our CEO discusses why generic security tools fail for voice protocols, how ESAP addresses RTC-specific vulnerabilities, and emerging AI threats in real-time communications.…