https://www.phllaps.net/tags/signalwire/ Recent content in SignalWire on PhllapsNET Hugo en-gb Mon, 09 Nov 2026 00:00:00 +0000 https://www.phllaps.net/posts/signalwire-freeswitch-code-injection-vulnerability/ Mon, 09 Nov 2026 00:00:00 +0000 https://www.phllaps.net/posts/signalwire-freeswitch-code-injection-vulnerability/ <div style="background:#b91c1c;color:white;padding:16px 18px;border-radius:14px;font-weight:800;font-size:18px;display:flex;align-items:center;gap:12px;box-shadow:0 10px 24px rgba(0,0,0,0.18);"><span style="font-size:24px;">🚨</span><span>SEVERITY: CRITICAL — CVSS 9.8</span><span style="opacity:0.95;font-weight:700;margin-left:auto;">Security Advisory</span></div> <h2 id="tldr-">TL;DR 📌</h2> <ul> <li>SignalWire FreeSwitch contains a code injection vulnerability that permits configuration and credential disclosure, arbitrary call control, and command execution.</li> <li>Highest CVSS: <strong>9.8 (Critical)</strong>.</li> <li><strong>Listed in CISA KEV</strong> (2026-11-09) — this is being exploited in the wild.</li> <li><strong>Check the advisory for fixed releases</strong> — remediation detail is in the vendor link below.</li> <li>CVEs: CVE-2026-116779.</li> </ul> <h2 id="what-it-is">What it is</h2> <p>CVE-2026-116779 is a code injection flaw in FreeSWITCH&rsquo;s SIP handling. The function <code>sofia_presence_handle_sip_i_message()</code> takes the &ldquo;To&rdquo; user field of an inbound SIP MESSAGE and splits it on a plus sign, treating the portion to the left as a chat protocol selector. If that selector is set to <code>api</code>, the request reaches <code>switch_api_execute()</code>, which runs FreeSWITCH API commands — including commands that execute operating system binaries — with the privileges of the FreeSWITCH daemon.</p>