CVE-2018-4058

Severity: high (CVSS 7.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-03-21 · updated 2026-06-17

Description

An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.5.0.9. By default, the TURN server allows relaying external traffic to the loopback interface of its own host. This can provide access to other private services running on that host, which can lead to further attacks. An attacker can set up a relay with a loopback address as the peer on an affected TURN server to trigger this vulnerability.

Affected products

coturn: before 4.5.0.9 — fixed in 4.5.0.9

How to fix

Upgrade to a fixed version: coturn 4.5.0.9. Check the vendor advisory for mitigations.

References

https://talosintelligence.com/vulnerability_reports/TALOS-2018-0732
https://talosintelligence.com/vulnerability_reports/TALOS-2018-0732

Get alerted when CVE-2018-4058 or the next vulnerability affects your stack