CVE-2026-10629 Overview
CVE-2026-10629 affects the Session Initiation Protocol (SIP) signaling stack in Verizon IP Multimedia Subsystem (IMS). The implementation transmits SIP signaling without IPsec integrity protection. Specifically, the stack omits Security-Client and Security-Server headers and does not establish Encapsulating Security Payload (ESP) traffic between the user equipment and the Proxy Call Session Control Function (P-CSCF). An on-path attacker can passively monitor and actively manipulate Voice over LTE (VoLTE) signaling across the radio and core network. This breaks confidentiality, integrity, and authenticity guarantees defined in 3GPP TS 33.203.
Critical Impact
Unauthenticated on-path attackers can intercept and modify VoLTE SIP signaling, enabling call metadata disclosure, message tampering, and identity manipulation across the carrier network.
Affected Products
- Verizon IMS SIP signaling stack (unspecified version)
- VoLTE subscribers traversing the affected IMS core
- User Equipment (UE) registering to the affected P-CSCF
Discovery Timeline
- 2026-06-02 - CVE-2026-10629 published to NVD
- 2026-06-03 - Last updated in NVD database
Technical Details for CVE-2026-10629
Vulnerability Analysis
The 3GPP IMS access security architecture requires IPsec ESP between the UE and the P-CSCF. The negotiation uses SIP Security-Client and Security-Server headers during registration to agree on integrity and ciphering algorithms. The Verizon IMS stack omits this negotiation and transmits SIP REGISTER, INVITE, BYE, and MESSAGE traffic in cleartext. The flaw maps to insecure communication and missing encryption weaknesses under the broader category of network protocol vulnerabilities.
VoLTE call control depends on signaling integrity for caller identity, routing, and supplementary services. Without ESP, every SIP header, including P-Asserted-Identity, Contact, Via, and SDP media descriptors, becomes readable and modifiable by anyone positioned on the bearer path.
Root Cause
The stack does not implement the IMS Authentication and Key Agreement (AKA) security-association negotiation required by 3GPP TS 33.203. The absence of Security-Client offers from the UE and Security-Server responses from the P-CSCF prevents establishment of ESP transport mode tunnels. SIP messages then traverse the Gm interface unprotected.
Attack Vector
An attacker with on-path access to the radio bearer or transport network can capture SIP traffic using standard network capture tools. Active manipulation requires the attacker to relay and rewrite SIP messages before forwarding them to the legitimate endpoint. Realistic positions include a rogue base station, a compromised transport node, or a passive radio interception platform. The attack complexity is rated High because positioning on the bearer path requires specialized capability, but no privileges or user interaction are required.
No verified proof-of-concept code is publicly available. Refer to the CERT Vulnerability Report #615987 and the 3GPP Technical Report TS 33.203 for protocol-level technical details.
Detection Methods for CVE-2026-10629
Indicators of Compromise
- Cleartext SIP messages observed on the Gm interface between UE and P-CSCF
- SIP REGISTER requests lacking Security-Client header offers
- 200 OK responses from the P-CSCF lacking Security-Server header parameters
- Absence of ESP (IP protocol 50) traffic alongside SIP exchanges
- Duplicate or rewritten P-Asserted-Identity values across consecutive dialogs
Detection Strategies
- Inspect packet captures from IMS access points for SIP traffic that is not encapsulated in ESP
- Audit P-CSCF logs for completed registrations that did not negotiate a security association
- Correlate VoLTE signaling anomalies with subscriber complaints about call drops, spoofed caller IDs, or unexpected supplementary service changes
Monitoring Recommendations
- Deploy passive probes at the Gm and Mw interfaces to alert on unprotected SIP flows
- Track the ratio of registrations completing the IMS-AKA SA negotiation versus those that do not
- Forward IMS core logs to a centralized analytics platform for longitudinal review of signaling integrity events
How to Mitigate CVE-2026-10629
Immediate Actions Required
- Contact the carrier or IMS vendor for firmware and configuration updates that enable IPsec ESP per 3GPP TS 33.203
- Enforce IMS-AKA on the P-CSCF so that registrations without Security-Client offers are rejected
- Restrict transport network access to authorized backhaul paths and apply MACsec or IPsec on transit links
Patch Information
No public vendor advisory or patch identifier is listed in the NVD record at this time. Operators should consult the CERT Vulnerability Report #615987 for coordinated disclosure status and follow updates from the affected carrier.
Workarounds
- Disable VoLTE for high-risk subscribers and fall back to circuit-switched voice where available
- Apply network-layer filtering on the access transport to drop unexpected SIP traffic outside approved peers
- Monitor for rogue base stations using radio environment scanners in sensitive deployment areas
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
