CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

FreeSWITCH

product · product:freeswitch single-source

Coverage
1
first 2026-11-06 → last 2026-11-06
Latest activity
2026-11-06
FreeSWITCH: one SIP MESSAGE runs API commands, vendor says exploited; fixed in 1.11.3
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
2
2 hosts

Action items (1)

Do-now tasks recorded on the entries about FreeSWITCH, newest first. Check the date before acting on an older one.

  • Upgrade every FreeSWITCH to 1.11.3, or until then set enable-chat=false on every SIP profile that does not need inbound SIP chat and remove directory users that have no password; on an instance that SIP peers could reach, rotate the SIP trunk and directory credentials stored in its configuration, because the advisory lists disclosure of configuration and credentials as an impact and says exploitation has been observed.
    2026-11-06CVE-2026-116779

Defender insights

What each entry about FreeSWITCH tells a defender to do, newest first.

2026-11-06NOTABLEexploitedFreeSWITCH: one SIP MESSAGE runs API commands, vendor says exploited; fixed in 1.11.3

Exposure · detection

Story timeline

  1. 2026-11-06CVE-2026-116779, FreeSWITCH 1.11.2 and earlier: one inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands, the vendor says exploitation has been observed, and 1.11.3 fixes it (CVSS 3.1 9.8)
    trending-vulnerabilitiesFreeSWITCH: one SIP MESSAGE runs API commands, vendor says exploited; fixed in 1.11.3

Hunting pivots

CVEs (exploited first)
CVE-2026-116779
Releases covered
FreeSWITCH
Tags
actively-exploiteddefault-configpatch-availablepre-authrcevulnerabilities
ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ExecutionCommand and Scripting Interpreter

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-11-06/cve-2026-116779-freeswitch-sip-message-api-command-execution · ATT&CK page ↗

Execution TA0002

T1059Command and Scripting Interpreter×1

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.

Evidence: 2026-11-06/cve-2026-116779-freeswitch-sip-message-api-command-execution · ATT&CK page ↗

Entries about FreeSWITCH (1)

2026-11-06 · view entry permalink →

NOTABLECVE-2026-116779exploitedNATOA2

CVE-2026-116779, FreeSWITCH 1.11.2 and earlier: one inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands, the vendor says exploitation has been observed, and 1.11.3 fixes it (CVSS 3.1 9.8)

SignalWire's advisory GHSA-mg63-h38w-8p9p describes CVE-2026-116779: FreeSWITCH's sofia_presence_handle_sip_i_message() splits the To user of an inbound SIP MESSAGE on + and treats the left half as a chat proto name, the mod_dptools module registers an api chat interface that hands its address to switch_api_execute(), and a peer that can deliver a MESSAGE to a profile therefore selects which FreeSWITCH API command the server runs (SignalWire, 2026-10-28). The impact is command execution with the privileges of the FreeSWITCH process, including arbitrary operating-system commands, disclosure of configuration and credentials and full call control, and where mod_lua is loaded, as the stock configuration does, inline Lua is a second route (SignalWire, 2026-10-28). The advisory scores it CVSS 3.1 9.8, lists 1.11.2 and earlier as affected and 1.11.3 as patched, and states that exploitation of this path has been observed in the wild without naming an actor or a victim (SignalWire, 2026-10-28). BSI CERT-Bund rated its advisory on the flaw critical and lists versions before 1.11.3 as affected (BSI CERT-Bund, 2026-11-05).

The default posture is exposed: chat handling is on unless a profile sets enable-chat=false, the stock vanilla configuration leaves it on for the internal and external profiles, and the inbound ACL does not cover MESSAGE; where MESSAGE authentication is enforced (the default from 1.10.7) any one account on the profile is enough, and installations that still carry the sample directory user default, which has no password, need no account of their own (SignalWire, 2026-10-28). The fix is a per-profile enable-chat-api-proto parameter that is off unless set, so the route is closed by default and a MESSAGE that selects the proto is answered with 403 and logged with the source and the requested command (SignalWire, 2026-10-28). auth-messages alone does not close the path, and disable_system_api_commands=true removes the system API but leaves the route to every other registered API, module loading and call origination included (SignalWire, 2026-10-28).

Exploitation of this path has been observed in the wild.

A peer that can deliver a MESSAGE to a profile therefore selects which FreeSWITCH API command the server runs.

No non-default setting is required.

SignalWire / FreeSWITCH
vulnerability06 Nov 03:42Zsingle-sourceOpen finding →
Sources: SignalWire / FreeSWITCH (GitHub security advisory GHSA-mg63-h38w-8p9p) · BSI CERT-Bund (WID-SEC-2026-4364)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • github.com1 (50%)
  • wid.cert-bund.de1 (50%)
All cited sources (2)