CVE-2018-19911 - CVE House
Back to Database
Status published High CVE-2018-19911

FreeSWITCH through 1.8.2, when mod_xml_rpc is enabled, allows remote attackers...

Vulnerability Description

FreeSWITCH through 1.8.2, when mod_xml_rpc is enabled, allows remote attackers to execute arbitrary commands via the api/system or txtapi/system (or api/bg_system or txtapi/bg_system) query string on TCP port 8080, as demonstrated by an api/system?calc URI. This can also be exploited via CSRF. Alternatively, the default password of works for the freeswitch account can sometimes be used.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-19911

Credits & Attribution

No credits recorded in the NVD database.

References

More from freeswitch

View All →
CVE-2023-32307
heap-over-flow and integer-overflow in sofia-sip
High 7.5
CVE-2023-22741
heap-over-flow in stun_parse_attribute in sofia-sip
Critical 9.8
CVE-2022-31003
Heap-based Buffer Overflow and Out-of-bounds Write in Sofia-SIP
Critical 9.1
CVE-2022-31002
Out-of-bounds Read in Sofia-SIP
High 7.5
CVE-2022-31001
Out-of-bounds Read in Sofia-SIP
High 7.5

Affected Vendor

Affected Software

freeswitch
Vulnerable Versions:
0

Timeline

Official Publish: December 6th, 2018
Last Modified: September 16th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.