SB2026110994 - Exposed dangerous method or function in freeswitch

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110994

SB2026110994 - Exposed dangerous method or function in freeswitch

Published: November 9, 2026

Security Bulletin ID SB2026110994
CSH Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Exposed dangerous method or function (CVE-ID: CVE-2026-116779) Exploited

CWE-ID: CWE-749 - Exposed Dangerous Method or Function

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to execute arbitrary operating system commands with the privileges of the FreeSWITCH process.

The vulnerability exists due to unrestricted selection of the api chat protocol through the To user of an inbound SIP MESSAGE accepted by a chat-enabled FreeSWITCH SIP profile. An unauthenticated remote attacker can use stock passwordless directory accounts to deliver a crafted MESSAGE that invokes command-executing APIs, while profiles enforcing authentication without passwordless accounts require valid account credentials.


Remediation

Install update from vendor's website.

References