FreeSWITCH Event Socket - Default Credentials (ClueCon)
FreeSWITCH (1.6.10 through 1.10.1, and any deployment that exposes mod_event_socket with its shipped configuration) ships event_socket.conf.xml with the hard-coded default password "ClueCon" (CVE-2019-19492, CWE-798). When the Event Socket Layer (ESL, TCP 8021) is reachable and the default password is unchanged, an unauthenticated remote attacker authenticates with "ClueCon" and gains full control of the switch - issuing FreeSWITCH API commands including bgapi system for OS command execution. This template connects to the ESL port and confirms the default password is accepted (+OK accepted). References: https://nvd.nist.gov/vuln/detail/CVE-2019-19492 https://vuldb.com/?id.146568 https://github.com/signalwire/freeswitch Remediation: Change the Event Socket password in event_socket.conf.xml from the default "ClueCon", set listen-ip to 127.0.0.1, apply an apply-inbound-acl, and never expose TCP 8021 to untrusted networks. Upgrade to FreeSWITCH 1.10.2 or later (binds the Event Socket to loopback by default).
10 assets checked · domain, subdomain, ipv4