CVE-2026-116786

Summary

In FreeSWITCH versions prior to 1.11.2, the sofia_handle_sip_i_refer() function improperly included raw Refer-To URI parameters and headers in a channel variable block passed to the originate parser. Because the parser treats commas as variable separators, an authenticated attacker on a bridged call can inject arbitrary channel variables—including execute_on_originate—leading to OS command execution via the system dialplan application.

Exploitability

Exploitation requires only a registered SIP account and the ability to place a call that triggers an off-box SIP REFER; no admin or Event Socket access is needed, and SIP REFER is enabled by default.

Blast radius

Successful exploitation grants the attacker OS-level command execution with FreeSWITCH process privileges, potentially compromising the host, pivoting to internal systems, or disrupting telephony services.

Detection

Monitor for originate events with unexpected execute_on_originate variables in channel variables, especially those containing system dialplan application calls prior to call answer; also inspect sofia REFER request Refer-To headers and parameters for suspicious comma-separated variable-like payloads.

Prioritized remediation

Upgrade to FreeSWITCH version 1.11.2 or later, where the vulnerability is fixed.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.