FreeSWITCH SIP MESSAGE injection exploited to run API and OS commands

A command injection flaw in SignalWire FreeSWITCH lets a SIP peer choose which FreeSWITCH API command the server runs by sending one SIP MESSAGE ¹. The result is command execution with the FreeSWITCH process's privileges. That includes arbitrary OS commands, reading configuration and credentials, and full call control ¹. Versions up to and including 1.11.2 are affected and 1.11.3 contains the fix ^1,2. The vendor rates it critical at CVSS 9.8 ¹.

Default deployments are exposed. Inbound chat stays enabled unless a profile sets enable-chat=false, and the shipped conf/vanilla configuration keeps it enabled on both its internal and external SIP profiles ¹. Where MESSAGE authentication is enforced, any account that can register is enough ¹. Installations that still carry the sample default.xml directory file need no account at all. That file defines a default user with no password, and such users authenticate unless allow-empty-password is set to false ¹. CISA notes that FreeSWITCH is an open-source component that other products may embed ³.

SignalWire's advisory, published 2026-10-28, says exploitation of this path has been observed in the wild ¹. CISA added the CVE to its KEV catalog on 2026-11-09 "based on evidence of active exploitation" ⁴. It set a 2026-11-12 remediation date and flagged the entry for forensic triage ^4,3. KEV lists ransomware use as unknown ³. Neither source names an actor, publishes indicators or gives a first-exploitation date ^1,3. It is therefore unknown whether attacks began before the fix shipped.

The bug is in mod_sofia's inbound MESSAGE handler, sofia_presence_handle_sip_i_message. The handler treats part of the To user as a chat-protocol selector and hands the message to whichever chat interface matches ¹. mod_dptools registers an api chat interface that passes its address to switch_api_execute(). As a result, the sender of an accepted MESSAGE decides which API command runs ¹. Nothing limits the selector, and protocols meant for message delivery are not separated from ones that execute commands ¹.

mod_lua adds a second reachable sink. The stock configuration loads mod_lua, and it accepts inline Lua with the full standard library ¹. Two common hardening steps do not help. The inbound ACL does not apply to MESSAGE, so tightening it leaves a profile in scope ¹. MESSAGE authentication has been on by default since 1.10.7, but it only raises the bar to one valid account or a passwordless directory user ¹.

The 1.11.3 release also adds the new gate to mod_verto and bounds the To-user split in the mod_sofia MESSAGE handler ². The advisory describes only the mod_sofia path, so it is not confirmed whether mod_verto was independently exposed ¹.

1. 1

   Upgrade to FreeSWITCH 1.11.3 or later. The vendor describes it as an important release with critical security fixes and urges all users to upgrade ^2,1.

2. 2

   Leave the new per-profile enable-chat-api-proto parameter unset. It defaults to off, which closes the api route on every profile, while normal chat messages route as before ¹. Enable it only where a trusted use case truly needs it.

3. 3

   If you cannot patch immediately, set enable-chat=false on every profile that does not need inbound SIP chat. This drops the message before the selector is parsed, but it also disables all inbound MESSAGE chat on that profile ¹.

4. 4

   Treat other hardening as partial. Enforcing auth-messages and removing passwordless directory users still leaves authenticated command execution ¹. disable_system_api_commands=true removes the system API but still leaves module loading and call origination reachable ¹.

5. 5

   Restrict SIP exposure with network-level filtering so only known peers and trunks can reach FreeSWITCH profiles. Do not rely on the FreeSWITCH inbound ACL, which does not cover MESSAGE ¹.

6. 6

   Investigate hosts that were reachable while unpatched as possibly compromised. The flaw exposes configuration and credentials and runs OS commands ^1,3. Rotate SIP account, trunk and other credentials stored in the FreeSWITCH configuration, and review the host for persistence.

7. 7

   Federal agencies must apply vendor mitigations per BOD 26-04 by 2026-11-12, or stop using the product if mitigations are unavailable ³.

• Inventory FreeSWITCH builds at 1.11.2 or earlier. Check for products that embed FreeSWITCH, since CISA notes it is an open-source component used elsewhere ³.
• Audit SIP profiles for enable-chat (on unless explicitly false). Audit the directory for users with neither a password nor an a1-hash, especially default from conf/vanilla/directory/default/default.xml and the Skinny example user ¹.
• On 1.11.3 and later, a MESSAGE that tries to select the api proto on a profile without enable-chat-api-proto gets a 403 response. The log entry includes the source and the requested command, so alert on these entries ¹.
• On unpatched hosts, review SIP logs or packet captures for inbound MESSAGE requests whose To user carries a chat-proto selector. Treat any reference to api or Lua as suspicious, and correlate with the source IPs and accounts that sent them.
• Hunt for child processes of the FreeSWITCH process, such as shells, downloaders or interpreters. Also look for unexpected module loads, unexplained call originations and new files in the FreeSWITCH install and config directories. These match the impact the vendor describes ¹.
• CISA has flagged this CVE for forensic triage under BOD 26-04. Federal agencies must check whether systems were compromised before the patch was applied, not just install it ⁴. Other organizations should do the same. Do not delay patching to do this.

1. Oct 28, 2026

   SignalWire publishes advisory GHSA-mg63-h38w-8p9p (critical, 9.8), stating exploitation has been observed in the wild. ¹

2. Nov 9, 2026

   CISA adds CVE-2026-116779 to the KEV catalog based on evidence of active exploitation, with forensic triage required. ⁴

3. Nov 12, 2026

   KEV remediation due date for federal agencies. ³

1. 1
   Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands

   SignalWire / FreeSWITCH (GitHub Security Advisory) · Vendor · Oct 28, 2026
2. 2
   FreeSWITCH v1.11.3 Release

   SignalWire / FreeSWITCH · Vendor
3. 3
   CISA KEV entry for CVE-2026-116779

   CISA · Government · Nov 9, 2026
4. 4
   CISA Adds Four Known Exploited Vulnerabilities to Catalog

   CISA · Government · Nov 9, 2026