{"id":"CVE-2026-116779","kind":"vulnerability","aliases":["CVE-2026-116779"],"related":[],"title":"FreeSWITCH: crafted SIP MESSAGE lets authenticated peers run system commands","description":"FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.3, sofia_presence_handle_sip_i_message() split the To user of an inbound SIP MESSAGE on a plus sign and treated the left side as a chat protocol selector. Selecting the api chat proto reached switch_api_execute(), allowing a peer whose MESSAGE was accepted to run FreeSWITCH API commands, including operating-system command sinks, with the daemon's privileges. Inbound chat is enabled on the stock internal and external profiles, and any authenticated profile account is sufficient; stock directory users without password material can also remove that barrier in affected configurations. The flaw permits configuration and credential disclosure, arbitrary call control, and command execution, and exploitation has been observed in the wild. This issue is fixed in version 1.11.3.","summary":"FreeSWITCH before 1.11.3 treats the left side of a plus sign in the To user of an inbound SIP MESSAGE as a chat protocol selector, and the api protocol passes the message to the API command executor. An authenticated peer whose message is accepted can run FreeSWITCH API commands, including operating-system command sinks, with the daemon's privileges.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freeswitch","runtime","self-hosted","sip","telecom"],"not_affected_if":["fixed-1.11.3-or-later","inbound-chat-disabled"],"how_to_check":"- Run `fs_cli -x 'version'` or check the installed FreeSWITCH version; affected versions are those before `1.11.3`.\n- Look at the sofia profile XML (internal and external) for inbound chat being enabled; it is enabled on the stock profiles.\n- Review directory users for accounts without password material, which the description says can remove the authentication barrier in affected configurations.","fix":"- FreeSWITCH: upgrade to `1.11.3`.","status":"open","published_at":"2026-11-05T20:17:44+00:00","first_seen_at":"2026-11-05T20:40:45+00:00","triaged_at":"2026-11-05T20:42:53+00:00","updated_at":"2026-11-05T20:42:53+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-05T20:42:53Z","model":"claude-haiku-5-5","output":{"fix":"- FreeSWITCH: upgrade to `1.11.3`.","reach":"network","title":"FreeSWITCH: crafted SIP MESSAGE lets authenticated peers run system commands","impact":"high","summary":"FreeSWITCH before 1.11.3 treats the left side of a plus sign in the To user of an inbound SIP MESSAGE as a chat protocol selector, and the api protocol passes the message to the API command executor. An authenticated peer whose message is accepted can run FreeSWITCH API commands, including operating-system command sinks, with the daemon's privileges.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["freeswitch","telecom","sip","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs operating-system commands on the telephony server","analyst_note":"The description says exploitation has been observed in the wild but the signal says exploited: no; check the vendor advisory (linked as github.com) to resolve the conflict.","how_to_check":"- Run `fs_cli -x 'version'` or check the installed FreeSWITCH version; affected versions are those before `1.11.3`.\n- Look at the sofia profile XML (internal and external) for inbound chat being enabled; it is enabled on the stock profiles.\n- Review directory users for accounts without password material, which the description says can remove the authentication barrier in affected configurations.","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-1.11.3-or-later","inbound-chat-disabled"],"who_is_affected":"Any FreeSWITCH server before 1.11.3 that accepts inbound SIP MESSAGE traffic is exposed, which includes the stock internal and external profiles. Any authenticated profile account is enough to reach the flaw, and stock directory users without password material can remove that barrier in affected configurations. Systems that have disabled inbound chat or run a patched 1.11.3 or later can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.00108,"input_tokens":4492,"output_tokens":1261,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-116779':13A,16A '-2026':12A,15A '1.11.3':26B,111C,232C 'accept':67B,156C 'account':188C 'affect':203C 'allow':150C 'also':198C 'api':51B,58B,71B,143C,148C,160C 'arbitrari':212C 'authent':6A,62B,186C 'barrier':201C 'call':213C 'chat':46B,138C,144C,174C 'command':10A,59B,72B,77B,161C,166C,216C 'commod':107C 'configur':204C,208C 'control':214C 'craft':2A 'credenti':210C 'cve':11A,14A 'daemon':81B,170C 'defin':88C 'digit':93C 'directori':192C 'disclosur':211C 'enabl':91C,176C 'execut':149C,217C 'executor':60B 'exploit':219C 'extern':182C 'fix':229C 'flaw':206C 'freeswitch':1A,17B,24B,70B,84C,159C 'handl':114C 'hardwar':108C 'host':21B 'implement':102C 'inbound':41B,124C,173C 'includ':73B,162C 'intern':180C 'issu':227C 'left':29B,134C 'let':5A 'materi':196C 'messag':4A,43B,55B,65B,117C,126C,154C 'observ':222C 'oper':75B,164C 'operating-system':74B,163C 'pass':53B 'password':195C 'peer':7A,63B,152C 'permit':207C 'plus':33B,129C 'presenc':113C 'prior':109C 'privileg':83B,172C 'profil':183C,187C 'proprietari':96C 'proto':145C 'protocol':47B,52B,139C 'reach':146C 'remov':199C 'run':8A,69B,104C,158C 'runtim':18B 'select':141C 'selector':48B,140C 'self':20B 'self-host':19B 'side':30B,135C 'sign':34B,130C 'sink':78B,167C 'sip':3A,22B,42B,115C,125C 'sofia':112C 'softwar':87C,101C 'split':118C 'stack':90C 'stock':179C,191C 'suffici':190C 'switch':98C,147C 'system':9A,76B,165C 'telecom':23B,89C,97C 'transform':94C 'treat':27B,132C 'user':38B,121C,193C 'version':231C 'whose':64B,153C 'wild':225C 'without':194C","nicknames":[],"mitigations":[],"who_affected":"Any FreeSWITCH server before 1.11.3 that accepts inbound SIP MESSAGE traffic is exposed, which includes the stock internal and external profiles. Any authenticated profile account is enough to reach the flaw, and stock directory users without password material can remove that barrier in affected configurations. Systems that have disabled inbound chat or run a patched 1.11.3 or later can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","freeswitch","runtime","selfhosted","sip","telecom"],"campaign_type":null,"first_public_at":"2026-10-28T16:46:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116779","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116779","severity":null,"published_at":"2026-11-05T20:17:44+00:00","modified_at":"2026-11-05T20:17:44+00:00","first_seen_at":"2026-11-05T20:40:45+00:00","fetched_at":"2026-11-05T20:40:45+00:00","note":null}],"documents":[{"id":79858,"url":"https://github.com/signalwire/freeswitch/commit/7015f6a73ab3d67fed5fbfc277ecfb88a74c2a86","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79859,"url":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79860,"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T16:46:07+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}