CVE-2026-116786: FreeSWITCH: Channel-variable injection via SIP REFER leads to command execution in mod_sofia
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, sofiahandlesipirefer() placed raw Refer-To URI parameters and headers inside a sipinviteparams channel-variable block passed to switchivroriginate(). The originate parser treated a comma in the attacker-controlled value as a variable separator, allowing an authenticated caller on a bridged call to inject arbitrary variables into a newly originated leg. An injected executeonoriginate value could invoke the system dialplan application before answer and execute operating-system commands with the FreeSWITCH process privileges. SIP REFER is enabled by default, and the sender needs only a registered account and a call that takes the off-box transfer path, not administrative or Event Socket access. This issue is fixed in version 1.11.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeSWITCHto a version that resolves this vulnerability.Fixed in 1.11.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a registered SIP account and must be able to place a bridged call that uses the off-box transfer path. Administrative access and Event Socket access are not required.
Are default deployments affected?
SIP REFER is enabled by default. Deployments using affected versions prior to 1.11.2 are exposed when registered callers can reach the relevant off-box transfer flow.
What level of access can successful exploitation provide?
The attacker can inject an execute_on_originate value that invokes the system dialplan application before the new call leg is answered. This can execute operating-system commands with the privileges of the FreeSWITCH process.
What should be done if an immediate upgrade is not possible?
Restrict or disable SIP REFER and prevent untrusted registered callers from using bridged calls that take the off-box transfer path. Upgrade to FreeSWITCH 1.11.2 when possible.