AI analysis
Claude Opus · 7 Nov 2026, 10:22 CET
FreeSWITCH SIP MESSAGE chat handling lets peers run API and system commands
FreeSWITCH versions before 1.11.3 let a SIP peer whose MESSAGE is accepted run FreeSWITCH API commands, including operating-system commands, with the daemon's privileges. Upgrade to 1.11.3 and restrict inbound SIP chat and accounts in the meantime.
In plain terms
FreeSWITCH is open-source telephony software that replaces traditional phone switches and handles voice calls and messaging over SIP (Session Initiation Protocol, the standard used to set up internet phone calls and send messages between phone systems). Before version 1.11.3, the way FreeSWITCH processed incoming SIP text messages could be abused so that a message was treated as an instruction to the server's internal command interface rather than as a chat message.
In practice, someone able to send an accepted message to the server could run administrative commands, including commands on the underlying operating system. They could read configuration and passwords, control calls, or take over the machine. Organisations running FreeSWITCH for internal phone systems, contact centres or VoIP services should treat this as urgent.