CVE-2018-19911: Freeswitch

High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days.

FreeSWITCH through 1.8.2, when mod_xml_rpc is enabled, allows remote attackers to execute arbitrary commands via the api/system or txtapi/system (or api/bg_system or txtapi/bg_system) query string on TCP port 8080, as demonstrated by an api/system?calc URI. This can also be exploited via CSRF. Alternatively, the default password of works for the freeswitch account can sometimes be used.

Affected products

• Freeswitch Freeswitch: up to and including 1.8.2

Published 2018-12-06. Last modified 2026-06-17.