FreeSWITCH Event Socket - Default Credentials (ClueCon)

criticalseverity

9.8CVSS score

29.4%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

FreeSWITCH (1.6.10 through 1.10.1, and any deployment that exposes mod_event_socket with its shipped configuration) ships event_socket.conf.xml with the hard-coded default password "ClueCon" (CVE-2019-19492, CWE-798). When the Event Socket Layer (ESL, TCP 8021) is reachable and the default password is unchanged, an unauthenticated remote attacker authenticates with "ClueCon" and gains full control of the switch - issuing FreeSWITCH API commands including bgapi system <cmd> for OS command execution. This template connects to the ESL port and confirms the default password is accepted (+OK accepted).

Impact

An attacker who authenticates to the Event Socket with the default password runs arbitrary FreeSWITCH API and OS commands (system / bgapi system), originates and intercepts calls, and reads configuration and credentials - full compromise of the telephony platform, as root in common deployments.

Fix

Change the Event Socket password in event_socket.conf.xml from the default "ClueCon", set listen-ip to 127.0.0.1, apply an apply-inbound-acl, and never expose TCP 8021 to untrusted networks. Upgrade to FreeSWITCH 1.10.2 or later (binds the Event Socket to loopback by default).

How to confirm it

Send: tcp probe to {{Hostname}}
Positive when: contains "command/reply" and "+OK accepted"

Run it with nuclei: nuclei -id CVE-2019-19492 -u <target>

The full check

id: CVE-2019-19492

info:
  name: FreeSWITCH Event Socket - Default Credentials (ClueCon)
  author: DhiyaneshDk
  severity: critical
  description: |
    FreeSWITCH (1.6.10 through 1.10.1, and any deployment that exposes mod_event_socket with its shipped configuration) ships event_socket.conf.xml with the hard-coded default password "ClueCon" (CVE-2019-19492, CWE-798). When the Event Socket Layer (ESL, TCP 8021) is reachable and the default password is unchanged, an unauthenticated remote attacker authenticates with "ClueCon" and gains full control of the switch - issuing FreeSWITCH API commands including bgapi system <cmd> for OS command execution. This template connects to the ESL port and confirms the default password is accepted (+OK accepted).
  impact: |
    An attacker who authenticates to the Event Socket with the default password runs arbitrary FreeSWITCH API and OS commands (system / bgapi system), originates and intercepts calls, and reads configuration and credentials - full compromise of the telephony platform, as root in common deployments.
  remediation: |
    Change the Event Socket password in event_socket.conf.xml from the default "ClueCon", set listen-ip to 127.0.0.1, apply an apply-inbound-acl, and never expose TCP 8021 to untrusted networks. Upgrade to FreeSWITCH 1.10.2 or later (binds the Event Socket to loopback by default).
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2019-19492
    - https://vuldb.com/?id.146568
    - https://github.com/signalwire/freeswitch
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-19492
    epss-score: 0.29448
    epss-percentile: 0.98211
    cwe-id: CWE-798
  metadata:
    verified: true
    max-request: 1
    shodan-query: product:"FreeSWITCH"
    fofa-query: app="FreeSWITCH"
  tags: cve,cve2019,freeswitch,default-login,esl,network,vkev

tcp:
  - inputs:
      - read: 1024
      - data: "auth ClueCon\n\n"
    host:
      - "{{Hostname}}"

    port: 8021

    read-size: 2048

    matchers:
      - type: word
        words:
          - "command/reply"
          - "+OK accepted"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from