Skip to content
Fencer Vulns
high 7.7

CVE-2018-4058 json

An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.5.0.9.

published 2019-03-21 7 y ago modified 2026-06-17 4 mo ago also EUVD-2018-15844

cvss
7.7
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 61%
public exploits
0
none known

Summary

An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.5.0.9. By default, the TURN server allows relaying external traffic to the loopback interface of its own host. This can provide access to other private services running on that host, which can lead to further attacks. An attacker can set up a relay with a loopback address as the peer on an affected TURN server to trigger this vulnerability.

Patch / fix

  • coturn_project coturn 4.5.0.9
  • coturn Debian 14, Debian 13, Debian 12 4.5.1.0-1

debian advisories DEBIAN-CVE-2018-4058

  • coturn Ubuntu 16.04 LTS 4.5.0.3-1ubuntu0.2
  • coturn Ubuntu 18.04 LTS 4.5.0.7-1ubuntu2.18.04.1

ubuntu advisories UBUNTU-CVE-2018-4058

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Exploit prediction

0.94% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 7.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
NVD 3.1 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N

Affected products

  • Talos coTURN

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.