{"id":"CVE-2026-116786","kind":"vulnerability","aliases":["CVE-2026-116786"],"related":[],"title":"FreeSWITCH: SIP REFER injection lets a caller run OS commands","description":"FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, sofia_handle_sip_i_refer() placed raw Refer-To URI parameters and headers inside a sip_invite_params channel-variable block passed to switch_ivr_originate(). The originate parser treated a comma in the attacker-controlled value as a variable separator, allowing an authenticated caller on a bridged call to inject arbitrary variables into a newly originated leg. An injected execute_on_originate value could invoke the system dialplan application before answer and execute operating-system commands with the FreeSWITCH process privileges. SIP REFER is enabled by default, and the sender needs only a registered account and a call that takes the off-box transfer path, not administrative or Event Socket access. This issue is fixed in version 1.11.2.","summary":"FreeSWITCH builds an originate command from attacker-supplied SIP Refer-To values without escaping commas, so an injected variable can set an execute_on_originate action. An authenticated SIP caller on a bridged call can then run operating-system commands with the FreeSWITCH process privileges.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freeswitch","runtime","self-hosted","sip","telecom","voip"],"not_affected_if":["no-sip-exposure","version-1.11.2-or-later"],"how_to_check":"- Check the installed version with `fs_cli -x version` or the FreeSWITCH package version, and compare against `1.11.2`.\n- Confirm whether SIP REFER handling is active in the sofia profile configuration (REFER is enabled by default).\n- Review whether external or registered SIP accounts can place calls that use off-box transfer.","fix":"- FreeSWITCH: upgrade to `1.11.2`.","status":"open","published_at":"2026-11-05T20:17:45+00:00","first_seen_at":"2026-11-05T20:40:45+00:00","triaged_at":"2026-11-05T20:42:55+00:00","updated_at":"2026-11-05T20:42:55+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-05T20:42:55Z","model":"claude-haiku-5-5","output":{"fix":"- FreeSWITCH: upgrade to `1.11.2`.","reach":"network","title":"FreeSWITCH: SIP REFER injection lets a caller run OS commands","impact":"high","summary":"FreeSWITCH builds an originate command from attacker-supplied SIP Refer-To values without escaping commas, so an injected variable can set an execute_on_originate action. An authenticated SIP caller on a bridged call can then run operating-system commands with the FreeSWITCH process privileges.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["freeswitch","sip","voip","telecom","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Operating-system commands run with FreeSWITCH process privileges.","analyst_note":"","how_to_check":"- Check the installed version with `fs_cli -x version` or the FreeSWITCH package version, and compare against `1.11.2`.\n- Confirm whether SIP REFER handling is active in the sofia profile configuration (REFER is enabled by default).\n- Review whether external or registered SIP accounts can place calls that use off-box transfer.","plain_action":"","needs_analyst":false,"not_affected_if":["version-1.11.2-or-later","no-sip-exposure"],"who_is_affected":"Deployments running FreeSWITCH before 1.11.2 that accept SIP calls from registered accounts are exposed, since REFER is enabled by default. Systems that accept no SIP traffic, or only admin-restricted or non-REFER calls, have a smaller exposure. Operators who already run 1.11.2 or later are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000755,"input_tokens":4481,"output_tokens":614,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116786':13A,16A '-2026':12A,15A '1.11.2':100C,224C 'access':217C 'account':200C 'action':52B 'administr':213C 'allow':145C 'answer':175C 'applic':173C 'arbitrari':155C 'attack':32B,138C 'attacker-control':137C 'attacker-suppli':31B 'authent':54B,147C 'block':123C 'box':209C 'bridg':59B,151C 'build':26B 'call':60B,152C,203C 'caller':7A,56B,148C 'channel':121C 'channel-vari':120C 'comma':41B,134C 'command':10A,29B,67B,181C 'commod':96C 'control':139C 'could':168C 'cve':11A,14A 'default':192C 'defin':77C 'dialplan':172C 'digit':82C 'enabl':80C,190C 'escap':40B 'event':215C 'execut':49B,164C,177C 'fix':221C 'freeswitch':1A,17B,25B,70B,73C,184C 'handl':102C 'hardwar':97C 'header':114C 'host':21B 'implement':91C 'inject':4A,44B,154C,163C 'insid':115C 'invit':118C 'invok':169C 'issu':219C 'ivr':127C 'leg':161C 'let':5A 'need':196C 'newli':159C 'off-box':207C 'oper':65B,179C 'operating-system':64B,178C 'origin':28B,51B,128C,130C,160C,166C 'os':9A 'param':119C 'paramet':112C 'parser':131C 'pass':124C 'path':211C 'place':106C 'prior':98C 'privileg':72B,186C 'process':71B,185C 'proprietari':85C 'raw':107C 'refer':3A,36B,105C,109C,188C 'refer-to':35B,108C 'regist':199C 'run':8A,63B,93C 'runtim':18B 'self':20B 'self-host':19B 'sender':195C 'separ':144C 'set':47B 'sip':2A,22B,34B,55B,103C,117C,187C 'socket':216C 'sofia':101C 'softwar':76C,90C 'stack':79C 'suppli':33B 'switch':87C,126C 'system':66B,171C,180C 'take':205C 'telecom':23B,78C,86C 'transfer':210C 'transform':83C 'treat':132C 'uri':111C 'valu':38B,140C,167C 'variabl':45B,122C,143C,156C 'version':223C 'voip':24B 'without':39B","nicknames":[],"mitigations":[],"who_affected":"Deployments running FreeSWITCH before 1.11.2 that accept SIP calls from registered accounts are exposed, since REFER is enabled by default. Systems that accept no SIP traffic, or only admin-restricted or non-REFER calls, have a smaller exposure. Operators who already run 1.11.2 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freeswitch","high","runtime","selfhosted","sip","telecom","voip"],"campaign_type":null,"first_public_at":"2026-10-28T16:59:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116786","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116786","severity":null,"published_at":"2026-11-05T20:17:45+00:00","modified_at":"2026-11-05T20:17:45+00:00","first_seen_at":"2026-11-05T20:40:45+00:00","fetched_at":"2026-11-05T20:40:45+00:00","note":null}],"documents":[{"id":79879,"url":"https://github.com/signalwire/freeswitch/commit/fbac12b451a146fdac5104d25d337145be989e84","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79176,"url":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79881,"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-xjxm-9qx6-w3fj","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-28T16:59:02+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}