What’s Vulnerable › Vulnerabilities

CVE-2018-19911

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-12-06 · updated 2026-06-17
• Weakness: CWE-77

Description

FreeSWITCH through 1.8.2, when mod_xml_rpc is enabled, allows remote attackers to execute arbitrary commands via the api/system or txtapi/system (or api/bg_system or txtapi/bg_system) query string on TCP port 8080, as demonstrated by an api/system?calc URI. This can also be exploited via CSRF. Alternatively, the default password of works for the freeswitch account can sometimes be used.

Affected products

• signalwire freeswitch: through 1.8.2

References

• https://github.com/iSafeBlue/freeswitch_rce/blob/master/README-en.md
• https://github.com/iSafeBlue/freeswitch_rce/blob/master/freeswitch_rce.py
• https://github.com/iSafeBlue/freeswitch_rce/blob/master/README-en.md
• https://github.com/iSafeBlue/freeswitch_rce/blob/master/freeswitch_rce.py

Get alerted when CVE-2018-19911 or the next vulnerability affects your stack