CVE-2026-46512 mwtcmi CVE debrief

Who should care

Administrators and users of Frogman headless PBX control system, especially those using versions prior to 1.6.2, should be aware of this critical vulnerability and take immediate action to update to the latest version. This vulnerability affects operators responsible for managing PBX systems, platform administrators, vulnerability management teams, and security teams that need to assess and mitigate this risk.

Technical summary

The vulnerability exists in the fm_dialplan_apply function of Frogman, a headless PBX control system, prior to version 1.6.2. This function accepted template parameters including greeting, dest, url, extension, code, and file. These parameters were used to write output to extensions_custom.conf without proper sanitization, allowing a PERM_WRITE caller with confirm:true to inject arbitrary Asterisk directives such as System(), Set(SHELL(...)), Goto, or Macro. This issue has been fixed in version 1.6.2. The vulnerability allows for potential code execution and affects administrators and users of Frogman headless PBX control system, especially those using versions prior to 1.6.2. Evidence is limited, and defenders should verify affected scope and severity with the vendor. The CVE record provides a basis for review, but additional verification is necessary.

Defensive priority

High Criticality Expected Due to Code Injection Risk

Recommended defensive actions

• Update Frogman to version 1.6.2 or later
• Restrict access to the fm_dialplan_apply function
• Monitor for suspicious activity
• Implement additional security measures, such as input validation and sanitization
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was discovered and reported by an unknown source. The CVE record was published on 2026-07-16T19:16:46.510Z and has not been modified since then. The NVD entry is currently in the 'Received' status. Evidence is limited, and defenders should verify the affected scope and severity with the vendor. The CVE record provides a basis for review, but additional verification is necessary.

Official resources