Exploit for Missing Authentication for Critical Function in Freeswitch

PewSWITCH A FreeSWITCH specific scanning and exploitation tool...

CVE-2021-41157

creationtimestamp| type| source ---|---|--- 2021-10-26 18:15:03+00:00| seen| https://t.me/cibsecurity/31223 2021-12-05 15:16:21+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/910 2021-12-05 16:34:15+00:00| published-proof-of-concept| https://t.me/BlueRedTeam/1278 2021-12-06...

CVE-2021-41157

CVE-2021-41157 affects FreeSWITCH where SIP SUBSCRIBE requests are not authenticated by default in affected releases. The issue allows unauthenticated subscriptions to user agent event notifications, posing privacy risks (e.g., monitoring SIP extensions). The advisory notes a fix in v1.10.6, but ...

FreeSWITCH 1.10.5 SIP SUBSCRIBE Missing Authentication

FreeSWITCH does not authenticate SIP SUBSCRIBE requests by default - Fixed versions: v1.10.7 - Enable Security Advisory: https://github.com/EnableSecurity/advisories/tree/master/ES2021-08-freeswitch-SIP-SUBSCRIBE-without-auth - Vendor Security Advisory:...