What happened
FreeSWITCH's sofia_presence_handle_sip_i_message() splits the To-user of an inbound SIP MESSAGE on '+', treating the left side as a chat protocol selector with no allow-list; selecting 'api' reaches switch_api_execute() and allows running OS commands as the daemon. Exploitation observed in the wild; added to CISA KEV on 2026-11-09 with a federal due date of 2026-11-12.
Why it matters
FreeSWITCH is the open-source softswitch underneath a large share of the world's VoIP and the telephony foundation for conversational-AI voice agents and contact-center AI. An attacker gets daemon-level command execution, SIP credential/trunk disclosure and arbitrary call control (toll fraud, call interception) on the very platform an AI voice agent answers through — an AI-deployment relevant path to the voice layer.
Attack vector
An unauthenticated (or any registered account) inbound SIP MESSAGE whose To-user splits on '+' to select the 'api' chat protocol reaches switch_api_execute(), letting the peer run FreeSWITCH API commands including OS-command sinks with the daemon's privileges — configuration/credential disclosure, arbitrary call control and command execution
Affected systems
SignalWire FreeSWITCH before 1.11.3 (inbound SIP MESSAGE chat path enabled on stock internal/external profiles)
Mitigation
Upgrade to FreeSWITCH 1.11.3 (adds enable-chat-api-proto gate, default off, returns 403 for disallowed selector); keep MESSAGE auth on and purge default directory credentials; set enable-chat=false if inbound chat is unused; restrict port 5060 to trusted peers/ACL/SBC; do not run FreeSWITCH as root (https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p)