CyberRota Analysis
AI-GeneratedCoturn versions prior to 4.16.0 are vulnerable due to a flaw in the addr_less_eq() function, which improperly handles component-wise comparisons for IPv6 address ranges. This allows authenticated TURN clients to relay traffic to IPv6 peers that should be restricted, potentially leading to unauthorized access and data exposure. Organizations using Coturn for TURN or STUN services should prioritize upgrading to version 4.16.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.16.0, addr_less_eq() in src/client/ns_turn_ioaddr.c uses a component-wise comparison for native IPv6 min-max intervals in ioa_addr_in_range(), allowing an authenticated TURN client to relay to an IPv6 peer that is numerically within a configured non-prefix-aligned denied-peer-ip range but is classified as outside it. This issue is fixed in version 4.16.0.