signalwire freeswitch

What this is

freeswitch can mistake part of an incoming message for an instruction to run commands. This can let the sender run their own program on the server.

How it can harm you

If freeswitch accepts the attacker's message, they can read settings and login details, control calls, and run commands with the program's permissions. An account that can sign in is sufficient; some affected configurations also allow access without a password.

How urgent it is

This vulnerability is already being used in attacks. Apply the correction promptly because an accepted message can let an attacker run commands on your server.

Who is affected

freeswitch versions earlier than 1.11.3 are affected.

What to do

Update freeswitch to 1.11.3, which the advisory identifies as fixing the problem. Consult the vendor advisory for verified update instructions.

How to check your server

Check the installed freeswitch version in its version information or installed package details, then compare it with the affected versions in the vendor advisory.

Check your server for free →