CYBUNKR

FreeSWITCH phone systems:one SIP message can run commands, and attackers are using it

Published

CVE-2026-116779 lets anyone who gets a SIP MESSAGE accepted run commands on a FreeSWITCH phone server. CISA says it is being exploited. Update to 1.11.3 or later, or ask your VoIP provider.

If your business phones run on FreeSWITCH, check it is on 1.11.3 or later today. That includes phone systems built on it, such as FusionPBX, and hosted VoIP services whose platform uses it. CVE-2026-116779 lets someone whose SIP MESSAGE is accepted run FreeSWITCH commands, including operating-system commands, with the phone server's own privileges (SignalWire advisory, CVE record).

SignalWire, which maintains FreeSWITCH, says exploitation has been observed in the wild (SignalWire advisory). CISA added it to its Known Exploited Vulnerabilities catalog on 9 November.

Who is affected

  • FreeSWITCH 1.11.2 and earlier. 1.11.3 fixes it (SignalWire advisory, release notes).
  • No unusual settings needed. Any SIP profile that accepts inbound MESSAGE is exposed, and that is the default: the stock configuration leaves chat on for both the internal and external profiles. Tightening the inbound ACL does not help, because it does not cover MESSAGE (SignalWire advisory).
  • The attacker needs one MESSAGE accepted. Where MESSAGE authentication is on, any single account on that profile is enough: an extension, a handset or a trunk peer. Systems that still have the stock default directory user, which has no password, need no account at all (SignalWire advisory).
  • What it gives them: command execution, configuration and credential disclosure, and full call control (SignalWire advisory). It is rated 9.8 out of 10 (CVE record).

What has been seen so far

A snapshot from 10 November:

  • The fix was merged on 26 August (GitHub) and shipped in 1.11.3 on 28 August, which SignalWire called “an important release containing critical security fixes” (release notes). The advisory followed on 28 October (SignalWire advisory) and the CVE on 5 November (CVE record). So the update has been out for over two months, but systems not updated since August are still open.
  • The advisory says exploitation of this path has been observed in the wild (SignalWire advisory). CISA added it to its catalog on 9 November, with a deadline of 12 November for US federal agencies (CISA). CIRCL's Vulnerability-Lookup has logged 21 sightings, one of them an exploitation report.
  • Neither SignalWire nor CISA has said who is exploiting it or how widely. CIRCL lists proof-of-concept mentions on Telegram, but we have not found published working exploit code.

What to do

  • Update FreeSWITCH to 1.11.3 or later and restart it. 1.11.3 adds an enable-chat-api-proto setting that is off unless you turn it on, which closes the route on every profile (SignalWire advisory).
  • If you can't update today, set enable-chat=false on every profile that doesn't need inbound SIP chat. Also remove directory users with no password or a1-hash (the stock config ships two, default and the Skinny example) and set disable_system_api_commands=true. SignalWire says those last two reduce the risk but do not close it on their own (SignalWire advisory).
  • Check for misuse: look at call records for calls nobody recognises, and at extensions, trunks and dialplans for changes you didn't make. Because the flaw can expose configuration and credentials (SignalWire advisory), change SIP and trunk passwords on any system that was exposed before it was updated.
  • Hosted phones, or a PBX looked after by an IT provider? Ask them whether the platform uses FreeSWITCH, whether it is on 1.11.3 or later, and whether they have checked it for signs of access.

How we can help

Worried your phone system has been accessed? Get in touch.

Sources