# CVE-2021-41158: FreeSWITCH vulnerable to SIP digest leak for configured gateways > Attackers can leak SIP digest responses to recover gateway passwords, enabling unauthorized access to configured telecom gateways. - **Severity:** Medium 5.8 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N`) - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 26 Oct 2021 - **Updated:** 4 Aug 2024 - **Also known as:** ALPINE-CVE-2021-41158, GHSA-3v3f-99mv-qvj4 ## What is CVE-2021-41158? CVE-2021-41158 is a medium-severity vulnerability in signalwire freeswitch, published on 26 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim. ### Official description FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.10.7, an attacker can perform a SIP digest leak attack against FreeSWITCH and receive the challenge response of a gateway configured on the FreeSWITCH server. This is done by challenging FreeSWITCH's SIP requests with the realm set to that of the gateway, thus forcing FreeSWITCH to respond with the challenge response which is based on the password of that targeted gateway. Abuse of this vulnerability allows attackers to potentially recover gateway passwords by performing a fast offline password cracking attack on the challenge response. The attacker does not require special network privileges, such as the ability to sniff the FreeSWITCH's network traffic, to exploit this issue. Instead, what is required for this attack to work is the ability to cause the victim server to send SIP request messages to the malicious party. Additionally, to exploit this issue, the attacker needs to specify the correct realm which might in some cases be considered secret. However, because many gateways are actually public, this information can easily be retrieved. The vulnerability appears to be due to the code which handles challenges in `sofia_reg.c`, `sofia_reg_handle_sip_r_challenge()` which does not check if the challenge is originating from the actual gateway. The lack of these checks allows arbitrary UACs (and gateways) to challenge any request sent by FreeSWITCH with the realm of the gateway being targeted. This issue is patched in version 10.10.7. Maintainers recommend that one should create an association between a SIP session for each gateway and its realm to make a check be put into place for this association when responding to challenges. Weakness: CWE-346 (Origin Validation Error), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) ## Which versions are affected by CVE-2021-41158? It affects 1 product. Products: Freeswitch Freeswitch. ## How do I fix CVE-2021-41158? Upgrade to a fixed version. ## Is CVE-2021-41158 being exploited? There is no known exploitation of CVE-2021-41158 in the wild and no public exploit code. ## Other vulnerabilities in signalwire freeswitch - [CVE-2026-49841](https://insights.sbomify.com/CVE-2026-49841/): FreeSWITCH: Pre-authentication heap buffer overflow in `mod_verto` HTTP POST body read (critical 9.8) - [CVE-2019-19492](https://insights.sbomify.com/CVE-2019-19492/): Hardcoded credentials in n/a (critical 9.8) - [CVE-2026-49840](https://insights.sbomify.com/CVE-2026-49840/): FreeSWITCH: Pre-authentication heap buffer overflow in libesl `Content-Length` parsing (critical 9.1) - [CVE-2021-41145](https://insights.sbomify.com/CVE-2021-41145/): FreeSWITCH susceptible to Denial of Service via SIP flooding (high 8.6) - [CVE-2026-45771](https://insights.sbomify.com/CVE-2026-45771/): Freeswitch Denial-of-Service in SIP PUBLISH Requests via XML Entity Expansion (high 7.5) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2021-41158 and fix it if it is affected. What it is: CVE-2021-41158 is a medium-severity vulnerability in signalwire freeswitch, published on 26 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim. Exploitation: There is no known exploitation of CVE-2021-41158 in the wild and no public exploit code. Affected product: signalwire freeswitch. No package-level version data is available, so check the vendor advisory linked from the reference page. Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2021-41158/ (Markdown: https://insights.sbomify.com/CVE-2021-41158/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2021-41158 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-41158 - OSV: https://osv.dev/vulnerability/CVE-2021-41158 --- From sbomify Insights: https://insights.sbomify.com/CVE-2021-41158/ Summaries are generated and may contain mistakes; the official description above is the record.