GHSA-4mc6-qmpp-g7gw
CVE Information
Impact
SRT control packets carry no Message Authentication Code (MAC). An attacker who has network access to the receiver's listening port, or who can observe an active session's 5-tuple (source IP, source port, destination IP, destination port, SRT socket ID) and send spoofed packets to the receiver, can send a forged KMREQ control message that causes the receiver's encryption state to transition from SECURED to BADSECRET. Once downgraded, the receiver accepts unencrypted data packets from any sender, enabling stream hijacking, content injection, and interruption of live media.
This vulnerability affects SRT receivers processing encrypted streams. Receivers in listener mode with accessible ports are directly exploitable. Receivers in any connection mode are exploitable if the attacker can observe the session's 5-tuple (source IP, destination IP, source UDP port, destination UDP port, and SRT socket ID) and send spoofed packets to the receiver. SRT senders are not affected. Unencrypted SRT sessions are not affected — the vulnerability specifically targets the mechanism that enforces encryption, causing the receiver to accept unencrypted data in place of the legitimate encrypted stream. Standard network security practices (VPN, private connectivity, network segmentation) significantly reduce the attack surface by limiting port accessibility and preventing observation or spoofing of session traffic.
Patches
https://github.com/Haivision/srt/releases/tag/v1.5.6 https://github.com/Haivision/srt/pull/3345
Workarounds
None at this time.
References
https://www.haivision.com/product-bulletin-srt-security-advisory/ https://srtalliance.org/srt-alliance-security-advisory/