Vulnerability in FreeSWITCH Software Allows Unauthorized Command Execution

CVE-2026-116786

What is CVE-2026-116786?

FreeSWITCH, a software-defined telecom stack, suffered from a vulnerability that allowed authenticated callers to exploit the sofia_handle_sip_i_refer() function. This function mishandled raw Refer-To URI parameters, leading to improper parsing and enabling attackers to inject arbitrary variables into the originate call process. Exploiting this vulnerability could allow for unauthorized execution of system-level commands via the FreeSWITCH process, creating a significant security risk. The vulnerability is present in versions prior to 1.11.2, which now includes necessary patches.

References