SIP signaling stack in Verizon IMS omits IPsec integrity protection, missing Security-Client/Security-Server headers and ESP traffic. This corresponds to CWE-311 Missing Cryptographic Integrity, allowing an on-path attacker to passively eavesdrop and actively manipulate unsecured SIP messages over the radio and core network, compromising confidentiality, integrity and authenticity of VoLTE signaling.

Verizon IMS (VoLTE) of unspecified version is affected. No other vendors or product versions are listed.

The vulnerability has a CVSS score of 7.4, EPSS score is < 1%, and it is not listed in the CISA KEV catalog. Nevertheless, the absence of integrity protection on a core telecommunication protocol means that an attacker who can position themselves on the network path can easily modify or forge call setup and teardown messages, potentially leading to service disruption, spoofed calls or fraud. The likely attack vector is passive and active eavesdropping over radio or core links, requiring no special privileges beyond network access.