A ready-made attack for a flaw in FreeSWITCH Event Socket is now public
KROMSE explanation
FreeSWITCH Event Socket has a security flaw (CVE-2019-19492). The official record says: FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml.
Not confirmed yet, but attack code is public, so attacks often follow within days.
Anyone running FreeSWITCH Event Socket.
- Install the maker's update for FreeSWITCH Event Socket as soon as it is out.
- Not sure if you use it? KROMSE can check your product for free.
