CVE-2021-41145 - CVE House
Back to Database
Status published High CVE-2021-41145

FreeSWITCH susceptible to Denial of Service via SIP flooding

Vulnerability Description

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. FreeSWITCH prior to version 1.10.7 is susceptible to Denial of Service via SIP flooding. When flooding FreeSWITCH with SIP messages, it was observed that after a number of seconds the process was killed by the operating system due to memory exhaustion. By abusing this vulnerability, an attacker is able to crash any FreeSWITCH instance by flooding it with SIP messages, leading to Denial of Service. The attack does not require authentication and can be carried out over UDP, TCP or TLS. This issue was patched in version 1.10.7.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-41145

Credits & Attribution

No credits recorded in the NVD database.

References

More from signalwire

View All →
CVE-2023-51443
FreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiation
High 7.5
CVE-2023-40019
FreeSWITCH allows authorized users to cause a denial of service attack by sending re-INVITE with SDP containing duplicate codec names
High 7.5
CVE-2023-40018
FreeSWITCH allows remote users to trigger out of bounds write by offering an ICE candidate with unknown component ID
High 7.5
CVE-2021-41158
FreeSWITCH vulnerable to SIP digest leak for configured gateways
Medium 5.8
CVE-2021-41157
FreeSWITCH does not authenticate SIP SUBSCRIBE requests by default
Medium 5.3

Affected Vendor

Affected Software

freeswitch
Vulnerable Versions:
< 1.10.7

Timeline

Official Publish: October 25th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Weaknesses (CWE)

CWE-400

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact