FreeSWITCH and IBM Aspera Faspex Both Score 9.8, Both Joined CISA's Exploited List Nov. 9

A single SIP MESSAGE can run commands on a FreeSWITCH server through CVE-2026-116779 (CVSS 9.8, 1.11.2 and earlier, no account needed where the stock default user remains), and IBM Aspera Faspex 5.0.0 through 5.0.19 has its own 9.8 authorization bypass (CVE-2026-123218). CISA added both to its Known Exploited Vulnerabilities catalog on Nov. 9 with a Nov. 12 deadline and a forensic-triage flag.

GPUStack and OpenSSH were added the same day; we covered those in GPUStack's loopback bypass and OpenSSH 10.6p2.

FreeSWITCH: what an attacker needs

The advisory, published Oct. 28 (GHSA-mg63-h38w-8p9p), says the SIP presence handler splits the To-user of an inbound MESSAGE and treats part of it as the name of a chat protocol. The mod_dptools module registers an "api" chat interface, so the sender picks which FreeSWITCH API command runs. The result is command execution with the process's privileges, exposure of configuration and credentials, and call control. The advisory states exploitation has been observed in the wild.

Any SIP profile that accepts inbound MESSAGE is exposed. Chat is on by default, and the stock vanilla internal and external profiles leave it on. The inbound ACL does not cover MESSAGE, so tightening it does not help. With MESSAGE authentication enforced, any one account on the profile is enough. Installs still carrying the default user from conf/vanilla/directory/default/default.xml need no account at all, since it has no password.

The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Here the score is accurate, because the preconditions in the advisory are shallow.

FreeSWITCH: the fix and the workarounds

Version 1.11.3 adds a per-profile enable-chat-api-proto parameter that is off by default. Rejected attempts get a 403 and are logged with the source and requested command. The advisory credits Örn Arnarson as reporter and Gunnlaugur as analyst.

Workarounds are partial. Setting enable-chat=false on profiles that do not need inbound chat blocks the message before the selector is parsed. Enabling auth-messages (on by default from 1.10.7) and removing users without passwords leaves authenticated command execution open, and setting disable_system_api_commands=true leaves other API routes open, the advisory says.

IBM Aspera Faspex: a score that disagrees with its text

Product	CVE	Affected	Fixed
FreeSWITCH	CVE-2026-116779	1.11.2 and earlier	1.11.3
IBM Aspera Faspex	CVE-2026-123218	5.0.0 to 5.0.19	5.0.19 PL1

IBM's bulletin says an authorized user could "craft a specific message to bypass user authorization" and gain full administrative privileges. CISA's entry also says an authenticated user. But IBM's vector is AV:N/AC:L/PR:N/UI:N, which means no privileges required. Both cannot be right, and the bulletin does not say which one is.

The bulletin lists no workaround, an empty acknowledgement section, a publication date of Nov. 7 and a modified date of Nov. 6, which predates it. On Linux the fix is 5.0.19 PL1, and IBM says to verify the faspex-core container image is 5.0.19 (1ce4b13, Fix Pack 1).

What to do

Patch FreeSWITCH to 1.11.3 or set enable-chat=false on profiles that do not need inbound chat, then check the logs for MESSAGE traffic from unknown sources. Faspex operators should install 5.0.19 PL1. The federal deadline for both is Nov. 12, and neither source fetched reports who is exploiting either flaw or how many servers are affected.