SockAnalyst
← All playbooks
CriticalExploited vuln · 2026-11-10

SignalWire FreeSWITCH CVE-2026-116779: one SIP MESSAGE can run FreeSWITCH API and OS commands, exploited in the wild

SockAnalyst · Security+ certified analyst.

What happened

CVE-2026-116779 (CVSS 9.8) is a command-injection flaw in SignalWire FreeSWITCH 1.11.2 and earlier. In mod_sofia, the inbound SIP MESSAGE handler splits the To user on a plus sign and treats the left side as a chat protocol name. mod_dptools registers an 'api' chat interface that passes its address to switch_api_execute(), so a peer that gets one MESSAGE accepted by a profile chooses which FreeSWITCH API command the server runs, with the daemon's privileges. That reaches OS commands, configuration and credential disclosure, and full call control; inline Lua is a second path where mod_lua is loaded. SignalWire's October 28 advisory says exploitation has been observed in the wild. CISA added it to the KEV catalog on November 9 with a November 12 deadline. Inbound chat is on by default on the stock internal and external profiles, and the inbound ACL does not cover MESSAGE.

Who's affected

FreeSWITCH 1.11.2 and earlier with any SIP profile that accepts inbound MESSAGE, which is the default. Where MESSAGE authentication is enforced, any one account on the profile (extension, handset or trunk peer) is enough. Installs that still carry the stock conf/vanilla default directory user with no password or a1-hash need no account at all. VoIP providers, contact centers and PBX platforms built on FreeSWITCH should check their profiles.

✅ Fix / patch

  • Upgrade to FreeSWITCH 1.11.3 or later. It adds a per-profile enable-chat-api-proto setting that is off by default, so selecting the api proto gets a 403 and is logged with the source and requested command.
  • If you cannot upgrade now, set enable-chat=false on every profile that does not need inbound SIP chat. SignalWire says this is the setting that stops the message before the selector is parsed.
  • Remove directory users that have no password or a1-hash (stock conf/vanilla ships two, default and the Skinny example). auth-messages alone and disable_system_api_commands=true reduce but do not close the path.
  • Because exploitation has been observed, review SIP traces, FreeSWITCH logs, call records and credentials for misuse; rotate SIP and API credentials if anything is suspicious.

🔎 Quick hunt check

No IOCs have been published by SignalWire or CISA. Hunt for inbound SIP MESSAGE requests whose To user starts with api+ (any case), FreeSWITCH logs showing api command execution from chat, and child processes such as sh, bash, curl or wget spawned by the freeswitch process. On 1.11.3 and later, 403 rejections for the api chat proto are logged with the source and command.

MITRE ATT&CK: T1190, T1059, T1059.004, T1552.001

IOCs

No IOCs (IPs, domains or hashes) published by the sources yet.

Hunt queries

Starting points built only from published indicators. Field names vary; tune before use.

(index=voip OR index=freeswitch OR index=network OR index=linux) ("MESSAGE sip:api+" OR "To: <sip:api+" OR "sip:API+" OR "chat proto api" OR "enable-chat-api-proto")
| stats count min(_time) as first max(_time) as last values(src_ip) as src_ip by host, sourcetype
| append [ search index=edr parent_process_name="freeswitch" process_name IN ("sh","bash","dash","curl","wget","python*","perl","nc") | stats count values(process) as cmd by host, user ]
// SIP MESSAGE selecting the api chat proto (CVE-2026-116779) and shells or downloaders spawned by FreeSWITCH
let sip = Syslog
| where TimeGenerated > ago(30d)
| where SyslogMessage has_any ("sip:api+","sip:API+","enable-chat-api-proto") or (SyslogMessage has "MESSAGE" and SyslogMessage has "api+")
| project TimeGenerated, Computer, SyslogMessage;
let proc = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName =~ "freeswitch"
| where FileName in~ ("sh","bash","dash","curl","wget","python3","perl","nc")
| project TimeGenerated, Computer=DeviceName, SyslogMessage=ProcessCommandLine;
union sip, proc
// SIP MESSAGE api-proto selection and FreeSWITCH spawning shells: CVE-2026-116779

See all hunt queries →

⏱ CISA deadline

CVE-2026-116779CVSS 9.8 Critical (v3.1, CNA)
--
Federal due 2026-11-12 · CISA KEV catalog

Sources

Related playbooks

Get the Weekly KEV & Hunt Pack free — plus the daily SOC brief.

Weekly email; daily brief on the website.

Subscribe free

Read the free weekly pack →