SIP signaling stack in Verizon IMS omits IPsec integrity protection, missing Security-Client/Security-Server headers and ESP traffic. This allows an on‑path attacker to passively eavesdrop and actively manipulate unsecured SIP messages over the radio and core network, compromising confidentiality, integrity and authenticity of VoLTE signaling.

Verizon IMS (VoLTE) of unspecified version is affected. No other vendors or product versions are listed.

The vulnerability has no published CVSS or EPSS score, and it is not currently listed in the CISA KEV catalog. Nevertheless, the absence of integrity protection on a core telecommunication protocol means that an attacker who can position themselves on the network path can easily modify or forge call setup and teardown messages, potentially leading to service disruption, spoofed calls or fraud. The attack vector is passive and active eavesdropping over radio or core links, requiring no special privileges beyond network access.