CVE Feed

    Dashboard / CVE / CVE-2018-4059

    CVE-2018-4059

    An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9. By default, the TURN server runs an unauthenticated telnet admin portal on the loopback interface. This can provide administrator access to the TURN server configuration, which can lead to additional attacks. An attacker who can get access to the telnet port can gain administrator access to the TURN server.

    Published:Mar 21, 2019
    Last Modified:Nov 21, 2024
    EPS:Mar 21, 2019
    EPSS Score:0.00798
    CVSS Score:9.8

    Affected Products

    Vendor
    Coturn Project
    Product
    Coturn

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-862 Missing Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-665 Exploitation of Thunderbolt Protection Flaws

    Related CVEs

    CVE-2026-40613 (CVSS 7.5) — Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute …
    CVE-2026-27624 (CVSS 7.2) — Coturn is a free open source implementation of TURN and STUN Server. Coturn is commonly configured to block lo…
    CVE-2025-69217 (CVSS 7.7) — coturn is a free open source implementation of TURN and STUN Server. Versions 4.6.2r5 through 4.7.0-r4 have a …
    CVE-2020-26262 (CVSS 7.2) — Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does…
    CVE-2020-4067 (CVSS 7) — In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized prope…
    CVE-2020-6061 (CVSS 9.8) — An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST r…
    CVE-2020-6062 (CVSS 7.5) — An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST request…
    CVE-2018-4058 (CVSS 7.7) — An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN pr…
    CVE-2018-4056 (CVSS 9.8) — An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High