SIP signaling stack in Verizon IMS

CVE-2026-10629 is not a classic software bug so much as a carrier-side security design gap: Verizon's VoLTE/IMS signaling path reportedly allows SIP registration and call-control traffic without the normal IMS IPsec integrity protections, specifically missing Security-Client/Security-Server negotiation and follow-on ESP protection. The published CVE record lists the affected product only as Verizon VoLTE with version UNKNOWN, which is a red flag for patch managers because there is no clean host-level version inventory to query or package to deploy. In practice, the exposed population is Verizon IMS/VoLTE sessions where the UE-to-P-CSCF signaling path is operating without integrity protection.

The vendor-style 9.1/CRITICAL score overrates enterprise urgency because it scores impact in a vacuum and ignores the hard prerequisite: the attacker must already be *on path* in a telecom context. That usually means radio-layer positioning, rogue base-station capability, carrier/core access, or another privileged network vantage point; it is not an internet-wide unauthenticated RCE against your servers or laptops. The flaw is real and standards-noncompliant, but for a 10,000-endpoint enterprise it is mostly a mobile-carrier risk to sensitive voice/SMS workflows, not a Monday-morning patch emergency.

Why this verdict

• Requires telecom-path access: moving from AV:N on paper to *real* exploitability, the attacker needs rogue radio/core/on-path capability, which is a massive downward pressure versus ordinary public-edge flaws.
• Not enterprise-scannable or internet-exposed: this does not present like a public web login, VPN, or exposed management port across 10,000 hosts.
• No active exploitation / no KEV / no public PoC: absent real-world abuse evidence, there is no reason to honor the vendor's CRITICAL label at face value.
• Blast radius is session-level signaling trust: bad for voice/SMS integrity, but not a turnkey path to domain admin, ransomware spread, or fleet-wide code execution.
• No defender-controlled patch object: the affected component is a carrier IMS deployment with version UNKNOWN, so this is more vendor-risk governance than endpoint patch operations.

Why not higher?

A higher rating would make sense only if this were broadly reachable by ordinary remote attackers or already under active exploitation. Instead, every practical path starts with a rare and expensive prerequisite: telecom on-path control. That sharply constrains both who can do it and how often it will matter to a typical enterprise fleet.

Why not lower?

This is not harmless paperwork. If the published observations are accurate, core security properties for carrier voice/SMS signaling are missing, and a capable attacker could tamper with or observe sensitive communications. Organizations with executives, journalists, field responders, or other high-risk mobile users should care even if this is not a patch fire drill.

1. Move sensitive mobile comms off native carrier SMS/voice — For high-risk users, prefer end-to-end encrypted messaging/calling apps for sensitive discussions so compromise of IMS SIP signaling has less operational value. Because this is a LOW verdict, there is no SLA (treat as backlog hygiene), but high-risk user groups should be migrated on the next normal mobility/security review cycle.
2. Escalate to your Verizon account team — Ask for written confirmation of whether your subscriber base has IMS IPsec integrity enabled, what rollout date applies, and how they validate Security-Client/Security-Server plus ESP in production. There is no SLA (treat as backlog hygiene) for LOW findings, but carrier attestation should be collected as part of vendor-risk management.
3. Validate with packet capture on a test device — Capture IMS registration/call setup from representative Verizon devices and verify whether security negotiation headers and ESP appear. For a LOW verdict there is no SLA (treat as backlog hygiene), but this is the only practical way to distinguish a stale advisory from a fixed rollout.
4. Segment high-risk use cases to Wi-Fi calling or managed alternatives — Where policy allows, steer executives or incident responders toward managed communication paths with stronger enterprise control and logging. There is no SLA (treat as backlog hygiene), but this reduces dependency on opaque carrier signaling trust.

Run this on an auditor workstation that has tshark installed, against a packet capture taken from a test handset's IMS/VoLTE session on Verizon. Invoke it as python3 verify_cve_2026_10629.py capture.pcapng; no root is needed to analyze an existing pcap, but capturing the traffic may require privileged access or mobile lab tooling.

#!/usr/bin/env python3
# verify_cve_2026_10629.py
# Check a pcap for signs of missing IMS SIP security negotiation / ESP protection.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=tool/runtime error

import shutil
import subprocess
import sys
from pathlib import Path

TSHARK = shutil.which('tshark')

if TSHARK is None:
    print('UNKNOWN - tshark not found in PATH')
    sys.exit(2)

if len(sys.argv) != 2:
    print(f'Usage: {Path(sys.argv[0]).name} <capture.pcap|pcapng>')
    sys.exit(2)

pcap = Path(sys.argv[1])
if not pcap.exists():
    print(f'UNKNOWN - file not found: {pcap}')
    sys.exit(2)

try:
    # Pull SIP methods and relevant IMS security headers if present.
    sip_cmd = [
        TSHARK, '-r', str(pcap), '-Y', 'sip', '-T', 'fields',
        '-E', 'separator=|', '-E', 'occurrence=f',
        '-e', 'frame.number',
        '-e', 'sip.Method',
        '-e', 'sip.Security.client',
        '-e', 'sip.Security.server',
        '-e', 'sip.Security.verify',
    ]
    sip_out = subprocess.run(sip_cmd, capture_output=True, text=True, check=False)

    if sip_out.returncode != 0:
        print('UNKNOWN - tshark failed while parsing SIP traffic')
        sys.exit(3)

    # Count ESP packets in the capture.
    esp_cmd = [TSHARK, '-r', str(pcap), '-Y', 'esp', '-T', 'fields', '-e', 'frame.number']
    esp_out = subprocess.run(esp_cmd, capture_output=True, text=True, check=False)
    if esp_out.returncode != 0:
        print('UNKNOWN - tshark failed while parsing ESP traffic')
        sys.exit(3)

    sip_lines = [ln for ln in sip_out.stdout.splitlines() if ln.strip()]
    esp_lines = [ln for ln in esp_out.stdout.splitlines() if ln.strip()]

    if not sip_lines:
        print('UNKNOWN - no SIP traffic found in capture')
        sys.exit(2)

    saw_register = False
    saw_security_header = False

    for line in sip_lines:
        parts = line.split('|')
        # frame|method|sec-client|sec-server|sec-verify
        while len(parts) < 5:
            parts.append('')
        _, method, sec_client, sec_server, sec_verify = [p.strip() for p in parts[:5]]

        if method.upper() == 'REGISTER':
            saw_register = True

        if sec_client or sec_server or sec_verify:
            saw_security_header = True

    esp_count = len(esp_lines)

    # Heuristic decision logic:
    # PATCHED if we see IMS security negotiation headers and any ESP traffic.
    # VULNERABLE if we see SIP REGISTER but no security headers and no ESP.
    # UNKNOWN otherwise.
    if saw_security_header and esp_count > 0:
        print('PATCHED - observed IMS security headers and ESP traffic')
        sys.exit(0)

    if saw_register and (not saw_security_header) and esp_count == 0:
        print('VULNERABLE - observed SIP REGISTER without IMS security headers and without ESP traffic')
        sys.exit(1)

    print('UNKNOWN - incomplete evidence; capture may be partial or environment may vary by device/network state')
    sys.exit(2)

except Exception as exc:
    print(f'UNKNOWN - runtime error: {exc}')
    sys.exit(3)

Sources

1. Official CVE JSON record for CVE-2026-10629
2. Vista Net write-up mirroring CERT coordination details
3. 3GPP specification details for TS 33.203
4. 3GPP TS 33.203 text excerpt PDF
5. Verizon Wireless network access requirements including IMS registration behavior
6. GSMA IR.92 IMS Profile for Voice and SMS
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS API documentation