CVE-2026-10629: CVE-2026-10629

Synopsis

This is a missing cryptographic protection vulnerability in the SIP signaling stack of Verizon IMS, the component that handles call setup and teardown for VoLTE (Voice over LTE) calls. An attacker positioned on the network path between the device and the IMS core can passively monitor unencrypted SIP messages or actively modify them without authentication, because the stack omits the IPsec integrity headers (Security-Client and Security-Server) and Encapsulating Security Payload (ESP) traffic that the 3GPP standard requires. Successful exploitation gives the attacker read access to call signaling metadata and the ability to tamper with call setup, effectively compromising the confidentiality, integrity, and authenticity of VoLTE calls. No upstream fix version has been published; HarborGuard tracks the advisory and will surface a patched-image rebuild as soon as one becomes available.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be on the network path between the UE (handset) and the IMS core, reachable over the radio access network or core transport, to intercept or inject SIP messages.

• AuthenticationNot required

  No credentials or account are required; the attack relies on passive monitoring or active injection of cleartext SIP traffic, not any authenticated session.

• Victim interactionNot required

  The victim does not need to click anything or take any action beyond initiating or receiving a VoLTE call.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must be precisely positioned on the network path (on-path or man-in-the-middle) and able to intercept or inject radio or core-network traffic, which requires deliberate setup rather than opportunistic access.

Blast Radius

• Reads SIP INVITE, BYE, and REGISTER messages, exposing call metadata including caller and callee identities, timing, and session parameters.
• Modifies SIP message headers or bodies in transit, allowing call redirection, session hijacking, or spoofed call termination.
• Undermines the authenticity of VoLTE signaling, enabling an attacker to impersonate the IMS core or a legitimate endpoint to the device.