FreeSWITCH CVE-2026-49843

Exploitation requires three concrete conditions: (1) mod_verto must be loaded and its JSON-RPC WebSocket endpoint must be network-reachable by the attacker - deployments that do not use mod_verto or that firewall the Verto port are not affected; (2) the attacker must know the exact session UUID of the target client currently connected to mod_verto - this UUID is not guessable by brute force if generated with sufficient entropy, and must be obtained through traffic interception, log access, application disclosure, or insider knowledge; (3) the attacker must be able to establish a TCP/WebSocket connection to the FreeSWITCH mod_verto port before the target's session expires. The CVSS vector PR:N confirms no authentication is required from the attacker's side. What limits exploitation is exclusively UUID knowledge: without a valid target sessid, the collision cannot be triggered. There is no requirement for special FreeSWITCH configuration beyond mod_verto being loaded; the vulnerability exists in the default mod_verto connection handling path.

The CVSS 5.3 Medium score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) accurately captures the network-accessible, zero-credential attack path but arguably understates operational impact for a telecom platform: forcibly terminating active voice and video calls in a production environment can constitute a significant denial-of-service against live communications infrastructure, beyond what 'Low' availability impact typically conveys. Attack complexity is genuinely low once the session UUID is known - no authentication bypass, heap spray, or race condition exploitation is involved; the vulnerability is a straightforward logic flaw in handler ordering. The critical limiting factor is UUID knowledge: session UUIDs are not guessable by brute force in any reasonable timeframe if properly random, so the realistic attacker profile is someone with network-level visibility (e.g., a TLS-stripping MITM, a co-tenant on shared infrastructure, or an insider). No EPSS score was supplied; no KEV listing exists; no public proof-of-concept has been identified at time of analysis. The combination of unauthenticated network access and low complexity suggests this would be automatable if UUID exposure were possible, but that secondary prerequisite substantially constrains mass exploitation. For organizations where mod_verto faces the public internet or untrusted tenants, risk is elevated relative to the CVSS score alone.

An attacker with visibility into a target FreeSWITCH deployment - for example, an internal network user or a co-tenant on shared VoIP infrastructure - observes or intercepts a legitimate client's session UUID from Verto WebSocket traffic or application logs. The attacker opens a new WebSocket connection to the mod_verto endpoint and sends an initial JSON-RPC frame containing the stolen sessid before any authentication exchange completes; the server inserts the attacker's connection into the global session hash, evicts the legitimate client with a verto.punt message, drops the victim's active calls, and closes their socket - achieving a targeted denial-of-service against a specific user. No public proof-of-concept code has been identified at time of analysis.