Port 5060 – SIP (Session Initiation Protocol)

Port 5060 is the default port for SIP (Session Initiation Protocol), the signaling protocol behind most modern VoIP. SIP sets up, modifies, and tears down real-time voice and video calls — it carries the REGISTER, INVITE, and BYE messages that phones and IP-PBXs exchange, while the actual audio and video travel separately over RTP on negotiated high UDP ports. Plain SIP on 5060 runs over UDP (and TCP) with no encryption, so an exposed port 5060 hands an attacker the call-control plane of your phone system — which is exactly why it’s one of the most probed ports on the internet.

Why It’s Open

Every IP phone, softphone, IP-PBX, and SIP trunk needs port 5060 to register endpoints and route calls. You’ll find it on Asterisk, FreePBX, FreeSWITCH, Kamailio, 3CX, and hosted/cloud PBX platforms, as well as SIP trunks to carriers, desk phones and ATAs, door intercoms, and conferencing gear. SIP is the modern successor to H.323 on port 1720, and it has largely replaced it for VoIP call setup.

The problem is that 5060 is frequently exposed straight to the internet so remote workers, branch phones, and carrier trunks can reach the PBX. Where port 5060 is answering, its encrypted sibling is often one scan away — check for SIP-TLS on port 5061, and remember the RTP media ports ride on separate high UDP ports.

Common Risks

• Cleartext signaling. Plain SIP on 5060 sends everything — call metadata, the URIs of who is calling whom, Caller-ID, and the SIP digest-auth challenge/response — unencrypted. Anyone on the path can sniff it with tcpdump or Wireshark and replay or crack the captured credentials. The fix is SIP-TLS on 5061; media stays in the clear too unless you also enable SRTP.
• Extension and user enumeration. SIP servers leak valid extensions by responding differently to REGISTER, OPTIONS, and INVITE — a 401/407 challenge for a real extension versus a 404 for one that doesn’t exist. That lets an attacker map every extension on the PBX before touching a password.
• Weak or default extension secrets and toll fraud. This is the number-one real-world impact. Once an attacker guesses or brute-forces an extension’s SIP secret, they register as that endpoint and place premium-rate or international calls, running up enormous bills — often overnight, before anyone notices.
• Registration hijacking. An attacker who can register as a victim’s extension overwrites its contact binding, so inbound calls are silently redirected to or intercepted by the attacker.
• Caller-ID spoofing and eavesdropping. SIP headers are trivial to forge for spoofed Caller-ID, and because RTP media is separate and usually unencrypted, captured audio can be reassembled into a recording of the call.
• SIP flood and INVITE/REGISTER DoS. A flood of INVITE or REGISTER messages — or a single malformed packet that trips a parser bug — can exhaust the PBX and drop live calls.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

Detect the service and grab the banner

nmap -sU -sV -p 5060 <target>

Run the SIP NSE scripts

nmap -sU -p 5060 --script=sip-methods,sip-enum-users <target>

Scan for SIP devices and enumerate extensions with SIPVicious

# Find live SIP services across a range
sipvicious_svmap 192.0.2.0/24

# Enumerate valid extensions on a PBX
sipvicious_svwar -m REGISTER -e 100-999 <target>

# Crack digest-auth passwords on a discovered extension
sipvicious_svcrack -u 101 -d wordlist.txt <target>

Send a raw OPTIONS ping with sipsak

sipsak -vv -s sip:100@<target>

Brute-force SIP accounts with Hydra

hydra -L users.txt -P passwords.txt sip://<target>

Metasploit modules

msfconsole -q
use auxiliary/scanner/sip/options
set RHOSTS <target>
run

use auxiliary/scanner/sip/enumerator
set RHOSTS <target>
run

Log every open SIP service, valid extension, and cracked secret you confirm so it lands in the final pentest report instead of a scratch terminal.

What to Look For

Known CVEs and Exploits

• CVE-2025-57819 — Pre-authentication remote code execution in the FreePBX Endpoint Manager module (before 15.0.66 / 16.0.89 / 17.0.3). Insufficiently sanitized input allows an unauthenticated attacker to bypass authentication, reach SQL-injection flows, and write OS commands into the database for code execution. CVSS 9.8, added to the CISA Known Exploited Vulnerabilities catalog after in-the-wild exploitation in August 2025. This is reached over the FreePBX web admin interface rather than SIP itself, but owning FreePBX means owning the SIP service on 5060.
• CVE-2024-35190 — Asterisk (18.23.0 / 20.8.0 / 21.3.0) incorrectly identifies all unauthorized SIP requests as the local PJSIP endpoint, an authentication-handling flaw that can let unauthenticated SIP requests be treated as trusted. CVSS 5.3; fixed in 18.23.1 / 20.8.1 / 21.3.1.
• CVE-2021-41157 — FreeSWITCH before 1.10.6 does not authenticate SIP SUBSCRIBE requests by default, so an attacker can subscribe to user-agent notifications without credentials (privacy leak and social-engineering vector). CVSS 5.3. Note: this is a FreeSWITCH flaw, not the Cisco IP-phone bug older references sometimes mislabel it as.
• CVE-2023-49786 — Asterisk (before 18.20.1 / 20.5.1 / 21.0.1) is susceptible to denial of service via a race condition in the DTLS-SRTP handshake during call setup. Sent continuously, it blocks all new encrypted calls. CVSS 5.9 (NIST) / 7.5 (CNA).
• CVE-2024-42491 — Asterisk NULL-pointer dereference crash: when Asterisk sends a SIP request to a URI whose host starts with .1 and res_resolver_unbound is loaded, the process crashes with a SEGV (DoS). CVSS 5.7; fixed in 18.24.3 / 20.9.3 / 21.4.3.

Mitigation

• Don’t expose 5060 to the internet. Put the PBX behind a Session Border Controller (SBC) or firewall, and restrict SIP to your carrier’s trunk IPs and known endpoints with a geo/IP allowlist. Most toll-fraud incidents start with a PBX that answered SIP from the whole world.
• Move to SIP-TLS and SRTP. Use SIP-TLS on port 5061 to encrypt signaling and SRTP to encrypt media, so credentials and calls can’t be sniffed off the wire.
• Enforce strong, unique per-extension secrets. Long random SIP secrets — never the extension number or a vendor default — plus fail2ban (or the PBX’s own auth-failure limits) to lock out brute-force from SIPVicious and friendly-scanner traffic.
• Disable guest/anonymous SIP. Turn off unauthenticated call routing (allowguest=no in Asterisk-style configs) so no one can dial through your trunk without registering.
• Rate-limit and deploy a SIP-aware IPS. Rate-limit REGISTER/INVITE and use an IPS or SBC that understands SIP to drop floods and malformed messages before they reach the stack.
• Monitor for enumeration and call-spending spikes. Alert on bursts of 401/407 responses (extension scanning) and on sudden international or premium-rate call volume — the earliest warning of active toll fraud.
• Patch the PBX. Keep Asterisk, FreePBX, FreeSWITCH, Kamailio, and your SIP phones current; the FreePBX and Asterisk CVEs above are all fixed in newer releases.

Real-World Example

Toll fraud through an exposed PBX is one of the most consistently exploited weaknesses on the internet. The pattern is almost mechanical: automated tools scan wide ranges of the IPv4 space for anything answering on port 5060 — the tell-tale friendly-scanner User-Agent from SIPVicious is a fixture in the logs of every internet-facing PBX — then enumerate extensions and brute-force their SIP secrets. As soon as one weak extension registers, the attacker routes a flood of calls to premium-rate or international numbers they profit from, a scheme known as International Revenue Share Fraud (IRSF). Bills can reach tens of thousands of dollars in a single weekend before the owner notices.

It scales because so many PBXs are deployed with 5060 open to the world and extension passwords left at defaults or set to the extension number. Industry bodies such as the Communications Fraud Control Association consistently put global telecom fraud losses in the billions of dollars a year, with PBX/toll fraud among the top methods. It’s a clean example of an attack that needs no software exploit at all — just an exposed port 5060 and a weak secret.

FAQ

What is port 5060 used for?

Port 5060 is the default port for SIP (Session Initiation Protocol), the signaling protocol that sets up, manages, and ends VoIP voice and video calls. It carries the REGISTER, INVITE, and BYE messages between phones and IP-PBXs like Asterisk and FreePBX; the actual audio and video ride separately over RTP on negotiated high UDP ports.

Is port 5060 secure?

Not by itself. Plain SIP on 5060 is unencrypted, so signaling and the digest-auth exchange can be sniffed, and exposed PBXs are constantly scanned for weak extensions and toll fraud. Treat an internet-facing port 5060 as something to lock down behind an SBC or firewall and to migrate to SIP-TLS on 5061.

Does SIP use TCP or UDP on port 5060?

Both. SIP on port 5060 most commonly runs over UDP, but the same port is also registered for TCP, which is used for larger messages and more reliable delivery. When testing, scan both — nmap -sU -sT -p 5060 — because a PBX may answer on one and not the other.

What is the difference between port 5060 and port 5061?

Port 5060 carries plain, unencrypted SIP. Port 5061 carries SIP over TLS (SIP-TLS), which encrypts the signaling so credentials and call metadata can’t be read off the wire. For any SIP exposed beyond a trusted network, 5061 with SIP-TLS — paired with SRTP for the media — is the secure choice.

How do I secure or close port 5060?

Keep the PBX behind an SBC or firewall and allowlist only your carrier trunk and known endpoints, switch to SIP-TLS on 5061 with SRTP, set strong unique per-extension secrets with fail2ban, disable guest/anonymous SIP, and patch the PBX. If a host doesn’t run VoIP at all, block 5060 entirely and confirm it’s closed with a rescan.

TL;DR

• Service: SIP (Session Initiation Protocol) — VoIP call signaling
• Default port: 5060/UDP and 5060/TCP (encrypted SIP-TLS is on 5061)
• Biggest risk: cleartext signaling, extension enumeration, and toll fraud from weak SIP secrets
• Mitigation: don’t expose 5060, move to SIP-TLS + SRTP, strong per-extension secrets + fail2ban, disable guest SIP, monitor for enumeration and call-spending spikes, patch the PBX