CVE-2026-116786 in FreeSWITCH
Summary
by MITRE • 11/05/2026
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, sofia_handle_sip_i_refer() placed raw Refer-To URI parameters and headers inside a sip_invite_params channel-variable block passed to switch_ivr_originate(). The originate parser treated a comma in the attacker-controlled value as a variable separator, allowing an authenticated caller on a bridged call to inject arbitrary variables into a newly originated leg. An injected execute_on_originate value could invoke the system dialplan application before answer and execute operating-system commands with the FreeSWITCH process privileges. SIP REFER is enabled by default, and the sender needs only a registered account and a call that takes the off-box transfer path, not administrative or Event Socket access. This issue is fixed in version 1.11.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/05/2026
FreeSWITCH serves as a critical software-defined telecommunications stack designed to facilitate the migration from proprietary hardware switches to flexible, commodity-hardware-based implementations. Within this architecture, the Sofia SIP stack module handles Session Initiation Protocol signaling, including call transfer operations via the REFER method. Prior to version 1.11.2, a significant security flaw existed in how the system processed parameters during these transfers. Specifically, the sofia_handle_sip_i_refer function incorrectly handled raw Refer-To URI parameters and headers by placing them directly into a sip_invite_params channel-variable block before passing this data to switch_ivr_originate for call setup. This architectural oversight created an injection vector that compromised the integrity of variable parsing within the originate process.
The core technical flaw stems from how the originate parser interprets input strings containing commas. In FreeSWITCH, comma-separated values in certain contexts are treated as delimiters for distinct variables or commands. Because the attacker-controlled Refer-To URI parameters were inserted into this block without adequate sanitization or escaping of special characters like commas, an authenticated user could manipulate these inputs to inject arbitrary channel variables. This vulnerability allows a caller who is already part of a bridged call and has registered access to execute code on the underlying operating system through dialplan applications that are triggered during the origination phase.
The operational impact of this vulnerability is severe, as it enables remote command execution with the privileges of the FreeSWITCH process. An attacker does not require administrative rights or Event Socket Protocol (ESP) access to exploit this flaw. The SIP REFER method is enabled by default in most configurations, and exploitation only requires that the victim be on a call that utilizes an off-box transfer path. By injecting specific execute_on_originate values via the manipulated URI parameters, the attacker can force the system dialplan application to run before the new leg of the call is answered, effectively bypassing standard authentication checks for command execution. This represents a critical breach in both confidentiality and integrity, as it allows unauthorized control over the telephony infrastructure from within an authenticated user session.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) due to the injection of executable commands through manipulated input data. It also relates to CWE-78 OS Command Injection and CWE-20 Improper Input Validation regarding the failure to sanitize special characters in URI parameters. In terms of adversary tactics, this exploit maps to MITRE ATT&CK techniques involving command execution via legitimate system utilities or scripts, specifically leveraging trusted processes like FreeSWITCH itself to maintain persistence or escalate privileges within the network environment.
Mitigation for this issue involves upgrading to version 1.11.2 or later, where the parsing logic has been corrected to prevent arbitrary variable injection through comma-separated values in REFER requests. Organizations should also review their SIP configurations to ensure that only necessary endpoints are exposed and consider implementing strict input validation on all URI parameters if custom modifications exist outside of standard patches. Additionally, running FreeSWITCH with minimal system privileges can help limit the impact of any successful exploitation by restricting the operating-system commands that can be executed via dialplan applications.