CVE-2026-46512: CWE-94: Improper Control of Generation of Code ('Code Injection') in mwtcmi frogman
CVE-2026-46512 is a critical code injection vulnerability in mwtcmi frogman prior to version 1.6.2. The vulnerability arises because the fm_dialplan_apply function accepted template parameters that could be used by a PERM_WRITE caller with confirm:true to inject arbitrary Asterisk directives. Only limited sanitization was applied, allowing injection of commands like System(), Set(SHELL(...)), Goto, or Macro. This issue allows an attacker with limited privileges to execute arbitrary code within the Asterisk PBX environment. The vulnerability is fixed in version 1.6.2.
AI Analysis
Technical Summary
mwtcmi frogman versions before 1.6.2 contain a code injection vulnerability (CWE-94) in the fm_dialplan_apply function. This function accepted several template parameters and wrote output to extensions_custom.conf with insufficient sanitization, specifically only sanitizing contextName(). A PERM_WRITE caller using confirm:true could exploit this to inject arbitrary Asterisk directives such as System(), Set(SHELL(...)), Goto, or Macro, leading to remote code execution within the PBX system. The vulnerability has a CVSS 3.1 score of 9.9 (critical) indicating network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. The issue is resolved in frogman version 1.6.2.
Potential Impact
An attacker with PERM_WRITE privileges and the ability to use confirm:true can inject arbitrary Asterisk directives, potentially executing arbitrary code on the PBX system. This can lead to full compromise of the affected system, including confidentiality, integrity, and availability impacts. The vulnerability is critical with a CVSS score of 9.9, indicating severe risk if exploited.
Mitigation Recommendations
This vulnerability is fixed in frogman version 1.6.2. Users should upgrade to version 1.6.2 or later to remediate this issue. No other official remediation or temporary fixes are documented. Since this is not a cloud service, patching the software is required to mitigate the risk.
CVE-2026-46512: CWE-94: Improper Control of Generation of Code ('Code Injection') in mwtcmi frogman
Description
CVE-2026-46512 is a critical code injection vulnerability in mwtcmi frogman prior to version 1.6.2. The vulnerability arises because the fm_dialplan_apply function accepted template parameters that could be used by a PERM_WRITE caller with confirm:true to inject arbitrary Asterisk directives. Only limited sanitization was applied, allowing injection of commands like System(), Set(SHELL(...)), Goto, or Macro. This issue allows an attacker with limited privileges to execute arbitrary code within the Asterisk PBX environment. The vulnerability is fixed in version 1.6.2.
CVSS v3.1
Score 9.9critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
mwtcmi frogman versions before 1.6.2 contain a code injection vulnerability (CWE-94) in the fm_dialplan_apply function. This function accepted several template parameters and wrote output to extensions_custom.conf with insufficient sanitization, specifically only sanitizing contextName(). A PERM_WRITE caller using confirm:true could exploit this to inject arbitrary Asterisk directives such as System(), Set(SHELL(...)), Goto, or Macro, leading to remote code execution within the PBX system. The vulnerability has a CVSS 3.1 score of 9.9 (critical) indicating network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. The issue is resolved in frogman version 1.6.2.
Potential Impact
An attacker with PERM_WRITE privileges and the ability to use confirm:true can inject arbitrary Asterisk directives, potentially executing arbitrary code on the PBX system. This can lead to full compromise of the affected system, including confidentiality, integrity, and availability impacts. The vulnerability is critical with a CVSS score of 9.9, indicating severe risk if exploited.
Mitigation Recommendations
This vulnerability is fixed in frogman version 1.6.2. Users should upgrade to version 1.6.2 or later to remediate this issue. No other official remediation or temporary fixes are documented. Since this is not a cloud service, patching the software is required to mitigate the risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-14T19:12:32.754Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a59206068715ace437c3efb
Added to database: 07/16/2026, 18:18:08 UTC
Last enriched: 07/16/2026, 18:33:05 UTC
Last updated: 07/16/2026, 19:26:58 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.