freeswitch

Records27All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical5CVSS 9.0–10.0

CVSS high16CVSS 7.0–8.9

Exploited now

freeswitch records in CISA KEV

No freeswitch vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Freeswitch 21 records HIGH

Records

27 records

TI-2023-08915 CVE-2023-22741

heap-over-flow in stun_parse_attribute in sofia-sip

HIGH 82

Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02482 Published 2023-01-19 Fixed in 1.13.11 CWE-120

TI-2022-13049 CVE-2022-31003

Heap-based Buffer Overflow and Out-of-bounds Write in Sofia-SIP

HIGH 81

Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04107 Published 2022-05-31 Fixed in 1.13.8 CWE-122

TI-2023-28097 CVE-2023-51443

FreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiation

HIGH 72

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01485 Published 2023-12-27 Fixed in 1.10.11 CWE-703

TI-2023-20909 CVE-2023-40019

Resource allocation without limits in signalwire freeswitch

HIGH 72

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00909 Published 2023-09-15 Fixed in 1.10.10 CWE-770

TI-2023-20908 CVE-2023-40018

FreeSWITCH allows remote users to trigger out of bounds write by offering an ICE candidate with unknown component ID

HIGH 72

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00994 Published 2023-09-15 Fixed in 1.10.10 CWE-787

TI-2023-15601 CVE-2023-32307

heap-over-flow and integer-overflow in sofia-sip

HIGH 72

Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01056 Published 2023-05-26 Fixed in 1.13.15 CWE-122

TI-2022-13048 CVE-2022-31002

Out-of-bounds Read in Sofia-SIP

HIGH 72

Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01925 Published 2022-05-31 Fixed in 1.13.8 CWE-125

TI-2026-74149 CVE-2026-110658 · GHSA-9vj3-xq9j-5vq6

Out-of-bounds read in Sofia-SIP MIME parser allows remote crashes

HIGH 70

Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msg_multipart_parse() that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00674 Published 2026-10-14 No fix listed CWE-125

TI-2019-14041 CVE-2019-19492 · GHSA-24cv-mgp7-4xjv

FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml.

HIGH 65

FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.29448 Published 2019-12-02 No fix listed CWE-798

TI-2026-36745 CVE-2026-49841

FreeSWITCH: Pre-authentication heap buffer overflow in `mod_verto` HTTP POST body read

MEDIUM 49

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00394 Published 2026-06-09 Fixed in 1.11.1 CWE-122

TI-2026-36744 CVE-2026-49840

FreeSWITCH: Pre-authentication heap buffer overflow in libesl `Content-Length` parsing

MEDIUM 45

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0031 Published 2026-06-09 Fixed in 1.11.1 CWE-122

TI-2021-17984 CVE-2021-41145

FreeSWITCH susceptible to Denial of Service via SIP flooding

MEDIUM 41

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.01651 Published 2021-10-25 Fixed in 1.10.7 CWE-400

TI-2015-06143 CVE-2015-7392 · GHSA-h2p5-8h8f-7g53

Heap-based buffer overflow in the parse_string function in libs/esl/src/esl_json.c in…

MEDIUM 40

Heap-based buffer overflow in the parse_string function in libs/esl/src/esl_json.c in FreeSWITCH before 1.4.23 and 1.6.x before 1.6.2 allows remote attackers to execute arbitrary code via a trailing \u in a json string t…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.04668 Published 2015-10-05 No fix listed CWE-119

TI-2026-36751 CVE-2026-49847

FreeSWITCH: Stack overflow in bundled cJSON parser via deeply nested JSON

LOW 39

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00414 Published 2026-06-09 Fixed in 1.11.1 CWE-674

TI-2026-36746 CVE-2026-49842

FreeSWITCH: Pre-authentication bandwidth amplification via `mod_verto` speed-test frames

LOW 39

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00449 Published 2026-06-09 Fixed in 1.11.1 CWE-400

TI-2026-36629 CVE-2026-49475

FreeSWITCH: Out-of-bounds memory access in core STUN attribute parsing

LOW 39

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00278 Published 2026-06-09 Fixed in 1.11.0 CWE-125

TI-2026-33508 CVE-2026-45771

Freeswitch Denial-of-Service in SIP PUBLISH Requests via XML Entity Expansion

LOW 39

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00343 Published 2026-06-09 Fixed in 1.11.0 CWE-776

TI-2021-15499 CVE-2021-37624

FreeSWITCH does not authenticate SIP MESSAGE requests, leading to spam and message spoofing

LOW 39

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03784 Published 2021-10-25 Fixed in 1.10.7 CWE-287

TI-2021-17946 CVE-2021-41105

FreeSWITCH susceptible to Denial of Service via invalid SRTP packets

LOW 38

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02521 Published 2021-10-25 Fixed in 1.10.7 CWE-20

TI-2018-14107 CVE-2018-19911 · GHSA-j9vc-vw64-7f9w

FreeSWITCH through 1.8.2, when mod_xml_rpc is enabled, allows remote attackers to execute…

LOW 38

FreeSWITCH through 1.8.2, when mod_xml_rpc is enabled, allows remote attackers to execute arbitrary commands via the api/system or txtapi/system (or api/bg_system or txtapi/bg_system) query string on TCP port 8080, as de…

CVSS 3.0HIGH 7.5 Network No auth User interaction EPSS 0.02696 Published 2018-12-06 No fix listed CWE-352

TI-2022-13047 CVE-2022-31001

Out-of-bounds Read in Sofia-SIP

LOW 37

Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0222 Published 2022-05-31 Fixed in 1.13.8 CWE-125

TI-2013-02000 CVE-2013-2238 · GHSA-hhwm-5rv2-8r77

Multiple buffer overflows in the switch_perform_substitution function in switch_regex.c…

LOW 35

Multiple buffer overflows in the switch_perform_substitution function in switch_regex.c in FreeSWITCH 1.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors relate…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.02708 Published 2013-09-30 No fix listed CWE-119

TI-2021-17997 CVE-2021-41158

FreeSWITCH vulnerable to SIP digest leak for configured gateways

LOW 34

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00825 Published 2021-10-26 Fixed in 1.10.7 CWE-200

TI-2026-36747 CVE-2026-49843

FreeSWITCH: Pre-authentication session eviction via attacker-chosen `sessid` in `mod_verto`

LOW 30

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00284 Published 2026-06-09 Fixed in 1.11.1 CWE-287

TI-2021-17996 CVE-2021-41157

FreeSWITCH does not authenticate SIP SUBSCRIBE requests by default

LOW 27

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01698 Published 2021-10-26 Fixed in 1.10.6 CWE-287

Open these records in search →

Critical	5
High	16
Medium	6
Low	0
No CVSS	0