Coturn CVE-2026-53449

Exploitation requires an authenticated administrator account with active access to the Coturn CLI management interface - this is enforced by the CVSS PR:H metric and the description's explicit 'authenticated admin with CLI access' qualifier. The psd (print sessions dump) command must be available in the CLI, and the target file must be writable by the OS user account under which the coturn process runs. Exploitation is strictly local (AV:L); remote unauthenticated exploitation is not possible. Limiting factors: the attacker must already hold Coturn admin credentials and local or network access to the management port; the overwrite payload is session dump data (not attacker-chosen arbitrary content), constraining the precision of any exploitation; and the impact scope is bounded by the coturn process user's filesystem write permissions. Organizations running coturn as a dedicated low-privilege service account with tightly scoped directory permissions face substantially reduced real-world risk.

The CVSS 3.1 vector AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H scores 6.0 (Medium), accurately reflecting that this is a local-only, high-privilege attack with no remote exploitation path. The requirement for an authenticated admin with CLI access (PR:H, AV:L) significantly constrains the attack surface to insiders or scenarios where admin credentials have already been compromised. There is no CISA KEV listing, no reported public POC, and no EPSS score provided in the source data. The tag 'Information Disclosure' in the intelligence metadata appears inconsistent with the actual impact (file overwrite, not data exfiltration) and should be treated as a metadata artifact rather than a confirmed impact class. The real-world priority is low for organizations with properly segmented admin access; however, in environments where the coturn process runs with broad filesystem permissions or where admin CLI access is shared, the integrity and availability impacts are genuine. This is not a fire-drill issue but warrants patching as part of normal maintenance cycles.

An authenticated Coturn CLI administrator - either a malicious insider or an attacker who has obtained admin credentials - connects to the management interface and issues a psd /etc/cron.d/coturn-backdoor command. The coturn process writes TURN session dump data to the specified cron path without validation, creating or overwriting the file with attacker-influenced content, which the cron daemon may subsequently execute as root. The attack requires no technical sophistication beyond CLI access once credentials are obtained.