FreeSWITCH’s Verto WebSocket module processes a special speed‑test frame (#SPU) before authentication. The module reads the declared payload size with atoi(), only rejecting non‑positive values, so an unauthenticated client can request a size large enough for INT_MAX bytes. The server then sends back roughly ten times that amount, about 20 GB per request, providing a powerful outbound bandwidth amplification vector. The flaw is a classic uncontrolled resource consumption problem (CWE‑400) and can be used to create a denial‑of‑service or abuse of network bandwidth.

SignalWire’s FreeSWITCH distribution with mod_verto is vulnerable in all releases before 1.11.1. The patch was included in FreeSWITCH 1.11.1 and later, which limits the speed‑test payload size to a safe bound.

The CVSS score of 7.5 indicates a high severity. Because the attack does not require authentication and relies only on a lightweight WebSocket frame, exploitation is straightforward for anyone who can reach the Verto endpoint. The EPSS score is not available, but the vulnerability is not yet listed in CISA KEV. System administrators should treat it as a high‑risk amplification flaw that can overwhelm outbound bandwidth and disrupt services if left unpatched.