What’s Vulnerable › Vulnerabilities

CVE-2018-6608

• Severity: medium (CVSS 4.3 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-03-28 · updated 2026-06-17
• Weakness: CWE-200

Description

In the WebRTC component in Opera 51.0.2830.55, after visiting a web site that attempts to gather complete client information (such as https://ip.voidsec.com), the browser can disclose a private IP address in a STUN request.

Affected products

• Opera Browser: 51.0.2830.55

References

• https://docs.google.com/spreadsheets/d/1Nm7mxfFvmdn-3Az-BtE5O0BIdbJiIAWUnkoAF_v_0ug/edit?usp=sharing
• https://github.com/VoidSec/WebRTC-Leak
• https://news.ycombinator.com/item?id=16699270
• https://voidsec.com/vpn-leak/
• https://www.bleepingcomputer.com/news/security/many-vpn-providers-leak-customers-ip-address-via-webrtc-bug/
• https://docs.google.com/spreadsheets/d/1Nm7mxfFvmdn-3Az-BtE5O0BIdbJiIAWUnkoAF_v_0ug/edit?usp=sharing
• https://github.com/VoidSec/WebRTC-Leak
• https://news.ycombinator.com/item?id=16699270
• https://voidsec.com/vpn-leak/
• https://www.bleepingcomputer.com/news/security/many-vpn-providers-leak-customers-ip-address-via-webrtc-bug/

Get alerted when CVE-2018-6608 or the next vulnerability affects your stack