SoBasically
← FrontpageCISA hallmark logoCISAAnalysis

CISA flags actively exploited FreeSWITCH command injection flaw

Abhishek Gawade
Abhishek GawadeinSoBasically
1 min readEdition: 2026-11-09-cybersecurity-advisories
Topographic elevation contour card for CISA flags actively exploited FreeSWITCH command injection flaw
VISUAL ARTWORK:Original editorial artwork. Third-party brand marks used under nominative fair use.

What happened.The Cybersecurity and Infrastructure Security Agency added an actively exploited remote code execution vulnerability in SignalWire FreeSWITCH to its Known Exploited Vulnerabilities catalog.

Why it matters.FreeSWITCH powers core voice-over-IP networks and carrier session border controllers. When SIP headers invoke administrative execution pathways without authentication, network intruders gain root shell execution and tap call audio. Infrastructure engineers must deploy FreeSWITCH 1.11.3 immediately. Operators without maintenance windows should disable inbound SIP chat handling across active Sofia profiles.

The technical specifications:

  • Vulnerability mechanics: Tracked as CVE-2026-116779 with a 9.8 CVSS score, the defect lets unauthenticated callers execute arbitrary commands.
  • Parsing flaw: The flaw resides in sofia_presence_handle_sip_i_message, where SIP headers split on a plus symbol treat the prefix as a chat protocol selector.
  • Execution pathway: Selecting the api protocol handler routes message payloads into switch_api_execute, invoking system command sinks with daemon privileges.
  • Remediation directive: CISA issued an emergency three-day remediation deadline under BOD 26-04, requiring federal agencies to patch by November 12, 2026.
  • Software release: SignalWire released FreeSWITCH 1.11.3, adding a per-profile parameter that disables the vulnerable chat API handler by default.
TOPICS:
#security#vulnerability#exploit-in-the-wild#critical-infrastructure#voip