FreeSWITCH through 1.8.2, when mod_xml_rpc is enabled, allows remote attackers to execute…
Priority LOW 38CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Tampering, Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-352 and CWE-77.
Summary
FreeSWITCH through 1.8.2, when mod_xml_rpc is enabled, allows remote attackers to execute arbitrary commands via the api/system or txtapi/system (or api/bg_system or txtapi/bg_system) query string on TCP port 8080, as demonstrated by an api/system?calc URI. This can also be exploited via CSRF. Alternatively, the default password of works for the freeswitch account can sometimes be used.
Why it matters now
EPSS 0.02696 85th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:freeswitch:freeswitch:*:*:*:*:*:*:*:* | up to 1.8.2 | Vulnerable | freeswitch |
- cpe:2.3:a:freeswitch:freeswitch:*:*:*:*:*:*:*:* Versions up to 1.8.2 Vulnerable ·freeswitch
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2018-19911
- 2026-10-03 Alias added: GHSA-j9vc-vw64-7f9w
References
More Freeswitch vulnerabilities
- TI-2023-28097 FreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiation CVSS 3.1HIGH 7.5
- TI-2023-20909 Resource allocation without limits in signalwire freeswitch CVSS 3.1HIGH 7.5
- TI-2023-20908 FreeSWITCH allows remote users to trigger out of bounds write by offering an ICE candidate with unknown component ID CVSS 3.1HIGH 7.5
- TI-2019-14041 FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml. CVSS 3.1CRITICAL 9.8
- TI-2026-36745 FreeSWITCH: Pre-authentication heap buffer overflow in `mod_verto` HTTP POST body read CVSS 3.1CRITICAL 9.8
- TI-2026-36744 FreeSWITCH: Pre-authentication heap buffer overflow in libesl `Content-Length` parsing CVSS 3.1CRITICAL 9.1
Sources
- CVE-2018-19911 · CVE Program
- CVE-2018-19911 · NVD
- FIRST EPSS
- GHSA-j9vc-vw64-7f9w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences