A critical stack-based buffer overflow vulnerability in Irontec sngrep allows unauthenticated remote attackers to achieve arbitrary code execution through specially crafted SIP packets.

The application fails to properly validate the length of SIP header fields, such as Call-ID or X-Call-ID, before copying them into a fixed 255-byte stack buffer. An unauthenticated attacker can exploit this by sending a malformed SIP packet, triggering a buffer overflow that leads to application crashes or remote code execution.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code with the privileges of the sngrep process, which is often deployed on network monitoring or VoIP infrastructure. Given the CVSS score of 9.8, this poses a severe risk of unauthorized system access, potential lateral movement within the network, and the compromise of sensitive voice traffic data.

Immediate Action: Update to the latest version of sngrep as soon as a security release is provided by the vendor. In the absence of an immediate patch, restrict network access to the sngrep instance to trusted management interfaces only.

Proactive Monitoring: Monitor network traffic and system logs for malformed SIP packets or unexpected application crashes. Review process logs for signs of unauthorized command execution or abnormal memory usage patterns.

Compensating Controls: Deploy a Web Application Firewall or an Intrusion Detection System (IDS) configured to inspect and drop SIP packets containing oversized header fields. Ensure that the sngrep service is running with the least privilege necessary to minimize potential impact if the process is compromised.

Public Exploit Available: No

This vulnerability represents a critical risk to the integrity and availability of network monitoring infrastructure. Administrators should prioritize the deployment of the vendor-supplied patch once available. Until such time, isolating the affected systems from untrusted network segments is the most effective method to prevent remote exploitation.