A malformed SIP MESSAGE field lets any authenticated SIP account, including stock directory users with no password set, run operating system commands as the FreeSWITCH daemon.