| Package | Affected versions | Patched versions |
|---|---|---|
| freeswitch | ≤ 1.8.2 |
FreeSWITCH through 1.8.2, when mod_xml_rpc is enabled, allows remote attackers to execute arbitrary commands via the api/system or txtapi/system (or api/bg_system or txtapi/bg_system) query string on TCP port 8080, as demonstrated by an api/system?calc URI. This can also be exploited via CSRF. Alternatively, the default password of works for the freeswitch account can sometimes be used.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free