CVE-2018-19911 is a critical vulnerability affecting FreeSWITCH through version 1.8.2, specifically when the mod_xml_rpc module is enabled. It allows remote attackers to execute arbitrary commands via crafted queries to the /api/system or /txtapi/system endpoints on TCP port 8080, potentially leading to full system compromise. This high-severity vulnerability (CVSS 7.5) can be exploited with high complexity, requiring user interaction (CSRF) or leveraging the default 'works' password for the 'freeswitch' account. While no public exploit code or active exploitation has been observed, and community discussion is minimal, the potential impact of remote code execution warrants attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.8.2CPE matchmatch criteria | cpe:2.3:a:freeswitch:freeswitch:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.4 Bluesky, 0.2 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.6 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.