CVE-2026-10629: Verizon IMS VoLTE Signaling Lacks IPsec Protection – Call Eavesdropping Risk

Technical summary

The vulnerability stems from the absence of IPsec Encapsulating Security Payload (ESP) protection and missing Security-Client/Security-Server SIP headers in Verizon's IMS signaling stack. The SIP protocol, which orchestrates VoLTE call establishment and teardown, is transmitted over the radio and core network without cryptographic integrity or confidentiality guarantees. An on-path attacker can passively intercept SIP messages to extract call metadata (caller, callee, timing, location hints) or actively modify messages to manipulate call routing, inject commands, or create denial-of-service conditions. The vulnerability affects an unspecified version range of the Verizon IMS platform, meaning deployment scope across Verizon's network requires clarification from the vendor.

Business impact

This vulnerability directly undermines the security posture of Verizon's VoLTE infrastructure and affects millions of subscribers. Business consequences include: (1) loss of call privacy—competitors, law enforcement, or criminal actors can monitor high-value communications; (2) call fraud and service disruption—attackers can redirect calls, hijack billing, or deny service to target users; (3) regulatory and compliance risk—telecommunications carriers are subject to FCC, HIPAA (if medical), and privacy law requirements; (4) brand and customer trust damage if exploits become public; (5) potential cascade effects if signaling manipulation triggers cascading network failures or incorrect call routing across carrier boundaries.

Affected systems

The vulnerability is specific to Verizon's IMS signaling stack, affecting VoLTE call processing and all dependent services (video calling, messaging integration, etc.). The precise version range is not disclosed in the CVE; organizations relying on Verizon's VoLTE or IMS-based services should treat this as potentially pervasive until Verizon issues a detailed advisory specifying affected versions and deployment scopes. Third-party devices and networks that interoperate with Verizon IMS may inherit secondary risk if they rely on the integrity of Verizon-originated signaling.

Exploitability

Exploitation requires network-level access (on-path position) such as control of a cell site, core network node, or BGP/DNS hijacking capability. The CVSS score of 7.4 reflects HIGH severity partly because the attack complexity is rated HIGH—the attacker must be positioned on the data path—but requires no authentication or user interaction. Passive interception is trivial once positioned; active manipulation requires understanding of SIP protocol semantics but is well within the capability of state-sponsored or advanced criminal actors. Public exploit code is not known to exist, but the technical barrier is low for motivated adversaries.

Remediation

Verizon must implement mandatory IPsec ESP encryption and authentication for all SIP signaling traffic, including Security-Client and Security-Server header negotiation per RFC 3329. This requires updates to the IMS signaling stack, core network infrastructure, and possibly endpoint provisioning. Until patched, network operators should enforce perimeter controls: restrict SIP traffic to trusted, encrypted tunnels; implement SIP-aware firewalls with protocol validation; monitor for anomalous call signaling patterns; and consider temporary use of alternate calling mechanisms (WiFi calling over encrypted networks) for sensitive communications.

Patch guidance

Verizon will release patches through its standard IMS platform update process. Verify the affected version range and deploy in coordination with service continuity plans, as IMS updates may require brief signaling service interruption. Test patches in a staging environment first, as SIP protocol changes can interact unexpectedly with third-party equipment. Once available, apply patches to all IMS nodes, SBC (Session Border Controller) instances, and provisioning systems. Confirm that Security-Client/Security-Server negotiation is enabled and that IPsec SA (Security Association) establishment is logged and monitored.

Detection guidance

Monitor IMS signaling traffic for: (1) SIP messages arriving without Security-Client or Security-Server headers when they should be present; (2) absence of IPsec ESP traffic on signaling interfaces; (3) unexpected SIP INVITE, CANCEL, or BYE messages from unknown sources; (4) mismatches between call setup records and actual SIP message flows; (5) geographic or temporal anomalies in VoLTE call origination. Deploy SIP-aware IDS/IPS rules to flag unencrypted or unsigned SIP signaling. Use IMS platform audit logs to correlate signaling events with call detail records (CDRs) and flag discrepancies.

Why prioritize this

HIGH severity is justified because: (1) confidentiality and integrity of telecommunications infrastructure are foundational to national security and commercial trust; (2) the vulnerability affects millions of VoLTE subscribers across a major carrier; (3) exploitation requires only network-level access, which state-sponsored actors routinely possess; (4) no user awareness or interaction is required to eavesdrop or manipulate calls; (5) the fix requires significant platform updates and coordination. While KEV status is not yet assigned, the risk profile warrants expedited patching and defensive monitoring.

Risk score, explained

CVSS 7.4 (HIGH) reflects: Attack Vector Network (exploitable over internet-connected infrastructure), Attack Complexity High (attacker must be on-path, limiting casual exploitation), Privileges Required None, User Interaction None, Scope Unchanged, Confidentiality High (call metadata and content exposure), Integrity High (call signaling manipulation), Availability None. The absence of Availability impact is appropriate because the attack does not directly cause service outage, but downstream impacts (call hijacking, misdirection) could indirectly affect availability. The score appropriately penalizes the lack of authentication and user interaction while crediting the on-path requirement.

Frequently asked questions