CVE-2026-10629: High severity Verizon IMS vulnerability
SIP signaling stack in Verizon IMS (unspecified version) implements SIP signaling without IPsec integrity protection (missing Security-Client/Security-Server headers and ESP traffic), which allows an on-path attacker to compromise confidentiality, integrity, and authenticity of VoLTE signaling via passive monitoring and active manipulation of unsecured SIP messages over the radio and core network.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Mitigate by ensuring SIP signaling for VoLTE in the Verizon IMS SIP signaling stack is protected with IPsec integrity/authentication (e.g., include the required Security-Client/Security-Server headers and use ESP traffic) so that on-path attackers cannot passively monitor or actively manipulate unsecured SIP messages.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10629?
CVE-2026-10629 has a severity rating of 7.4 on the CVSS scale, indicating it is considered high risk.
How do I fix CVE-2026-10629?
To fix CVE-2026-10629, ensure that IPsec integrity protection is implemented for SIP signaling, including the necessary Security-Client/Security-Server headers.
What type of vulnerability is CVE-2026-10629?
CVE-2026-10629 is a vulnerability in the SIP signaling stack of Verizon IMS that allows for potential compromise of VoLTE signaling.
What impact does CVE-2026-10629 have on VoLTE signaling?
CVE-2026-10629 can lead to the compromise of confidentiality, integrity, and authenticity of VoLTE signaling due to the lack of IPsec protection.
Who is affected by CVE-2026-10629?
CVE-2026-10629 affects users and systems utilizing the vulnerable versions of the Verizon IMS SIP signaling stack.