How severe is CVE-2018-4059?

CVE-2018-4059 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2018-4059 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (77th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2018-4059?

CVE-2018-4059 affects Coturn Project Coturn. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2018-4059?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2018-4059 published?

CVE-2018-4059 was published on 2019-03-21 and last updated on 2026-06-17.

CVE-2018-4059

CVE-2018-4059 is a critical-severity vulnerability in Coturn Project Coturn with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-862.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v2: 10.0
EPSS exploit prediction: 2% (77th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-862
Affected product: Coturn Project Coturn
Published: 2019-03-21
Last modified: 2026-06-17

Description

An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9. By default, the TURN server runs an unauthenticated telnet admin portal on the loopback interface. This can provide administrator access to the TURN server configuration, which can lead to additional attacks. An attacker who can get access to the telnet port can gain administrator access to the TURN server.

Frequently asked questions

What is CVE-2018-4059?: An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9. By default, the TURN server runs an unauthenticated telnet admin portal on the loopback interface. This can provide administrator access to the TURN server configuration, which can lead to additional attacks. An attacker who can get access to the telnet port can gain administrator access to the TURN server.
How severe is CVE-2018-4059?: CVE-2018-4059 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2018-4059 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (77th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2018-4059?: CVE-2018-4059 affects Coturn Project Coturn. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2018-4059?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2018-4059 published?: CVE-2018-4059 was published on 2019-03-21 and last updated on 2026-06-17.

References

https://talosintelligence.com/vulnerability_reports/TALOS-2018-0733

Affected products (1)

cpe:2.3:a:coturn_project:coturn:*:*:*:*:*:*:*:*

More vulnerabilities in Coturn Project Coturn

CVE-2020-6061 — Critical (CVSS 9.8): An exploitable heap out-of-bounds read vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests.…
CVE-2018-4056 — Critical (CVSS 9.8): An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version…
CVE-2026-43994 — High (CVSS 8.1): Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.10.0 contain a stack buffer…
CVE-2018-4058 — High (CVSS 7.7): An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to…
CVE-2026-40613 — High (CVSS 7.5): Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.10.0, the STUN/TURN attribute parsing…
CVE-2020-6062 — High (CVSS 7.5): An exploitable denial-of-service vulnerability exists in the way CoTURN 4.5.1.1 web server parses POST requests. A…

All CVEs affecting Coturn Project Coturn →

Other CWE-862 (Missing Authorization) vulnerabilities

CVE-2026-0092 — Critical (CVSS 10.0): In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could…
CVE-2026-33712 — Critical (CVSS 10.0): Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the preview chat endpoint (POST…
CVE-2026-2031 — Critical (CVSS 10.0): An Improper Access Control vulnerability in several internal API endpoints for Google Cloud Application Integration…
CVE-2026-34976 — Critical (CVSS 10.0): Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing…
CVE-2025-30416 — Critical (CVSS 10.0): Sensitive data disclosure and manipulation due to missing authorization. The following products are affected: Acronis…
CVE-2025-45854 — Critical (CVSS 10.0): /server/executeExec of JEHC-BPM 2.0.1 allows attackers to execute arbitrary code via execParams.

Browse all CWE-862 (Missing Authorization) vulnerabilities →