{"id":"CVE-2026-116786","published":"2026-11-05T20:17:45.900","lastModified":"2026-11-05T22:38:13.080","description":"FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, sofia_handle_sip_i_refer() placed raw Refer-To URI parameters and headers inside a sip_invite_params channel-variable block passed to switch_ivr_originate(). The originate parser treated a comma in the attacker-controlled value as a variable separator, allowing an authenticated caller on a bridged call to inject arbitrary variables into a newly originated leg. An injected execute_on_originate value could invoke the system dialplan application before answer and execute operating-system commands with the FreeSWITCH process privileges. SIP REFER is enabled by default, and the sender needs only a registered account and a call that takes the off-box transfer path, not administrative or Event Socket access. This issue is fixed in version 1.11.2.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-77","CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://github.com/signalwire/freeswitch/commit/fbac12b451a146fdac5104d25d337145be989e84","tags":[]},{"url":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.2","tags":[]},{"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-xjxm-9qx6-w3fj","tags":[]}],"exploitRefs":[{"url":"https://github.com/signalwire/freeswitch/commit/fbac12b451a146fdac5104d25d337145be989e84","tags":[]},{"url":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.2","tags":[]},{"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-xjxm-9qx6-w3fj","tags":[]}],"hasPoc":true,"ai":{"summary":"In FreeSWITCH versions prior to 1.11.2, the sofia_handle_sip_i_refer() function improperly included raw Refer-To URI parameters and headers in a channel variable block passed to the originate parser. Because the parser treats commas as variable separators, an authenticated attacker on a bridged call can inject arbitrary channel variables—including execute_on_originate—leading to OS command execution via the system dialplan application.","exploitability":"Exploitation requires only a registered SIP account and the ability to place a call that triggers an off-box SIP REFER; no admin or Event Socket access is needed, and SIP REFER is enabled by default.","blast_radius":"Successful exploitation grants the attacker OS-level command execution with FreeSWITCH process privileges, potentially compromising the host, pivoting to internal systems, or disrupting telephony services.","remediation":"Upgrade to FreeSWITCH version 1.11.2 or later, where the vulnerability is fixed.","detection":"Monitor for originate events with unexpected execute_on_originate variables in channel variables, especially those containing system dialplan application calls prior to call answer; also inspect sofia REFER request Refer-To headers and parameters for suspicious comma-separated variable-like payloads.","tags":["rce","injection","telephony","sip","dialplan"],"model":"garnet-coder","analyzedAt":"2026-11-06T09:55:38.538Z"}}