Skip to content
eastbaycyber

CVE-2026-46512: Frogman Dialplan Code Injection

CVE explainers 10 min read
SR
Security Research Desk Expert reviewed
Threat intelligence · Human-verified · Updated 2026-07-23
▲ Escalation ViewOne CVE, briefed at three altitudes — skim the Brief, weigh the Impact, or work the Runbook. The way a SOC actually reads it.
CISOBrief · 30-second brief

TL;DR - Frogman before 1.6.2 allows authenticated directive injection into extensions_custom.conf. - Affected admins should upgrade to 1.6.2 and audit PERM_WRITE users immediately. - No confirmed in-the-wild exploitation is publicly documented, but impact is critical.

Vulnerability at a Glance

Field Value
CVE ID CVE-2026-46512
CVSS v3.1 9.9 Critical
Attack vector Network (AV:N)
Auth required Yes, low privileges (PR:L), specifically a caller with PERM_WRITE
Patch available Yes, fixed in Frogman 1.6.2

CVE-2026-46512 is a critical authenticated code injection issue in Frogman, a project described in the NVD as providing headless PBX control through MCP and HTTP API. The flaw exists in the dialplan application workflow and can let a low-privileged but authenticated caller inject arbitrary Asterisk directives into extensions_custom.conf.

What makes this notable for defenders is not just the headline CVSS score of 9.9, but the target environment. This is a PBX control surface. A successful exploit can affect call routing, dialplan behavior, and potentially underlying host execution if dangerous Asterisk functions are permitted in the environment. In telephony stacks, configuration injection often has broader operational consequences than a typical web app bug.

What Is This Vulnerability?

According to the NVD description, the vulnerable path involves fm_dialplan_apply, Tools/DialplanApply.php, Dialplan/Templates.php, and Dialplan/TemplateBase.php. Prior to version 1.6.2, Frogman accepted template parameters such as greeting, dest, url, extension, code, and file, then wrote rendered output into extensions_custom.conf. Only contextName() in Dialplan/TemplateBase.php:38-42 was sanitized. Other parameters remained unsafe.

The core issue is insufficient input validation and sanitization before generating Asterisk dialplan content. Because user-controlled fields were allowed to reach extensions_custom.conf, an attacker with the required application permission could inject Asterisk directives directly into the dialplan. The NVD explicitly calls out dangerous primitives including System(), Set(SHELL(...)), Goto, and Macro.

That distinction matters. This is not described as a generic input bug with speculative impact. The published vulnerability details identify the exact sink, the file written, the required permission level, and examples of the injected directives. In a PBX context, these directives can be used to manipulate call flow, create persistence, exfiltrate information, or invoke host-level actions depending on Asterisk configuration and runtime permissions.

A further detail defenders should not miss is the exploitation precondition: the caller must have PERM_WRITE and use confirm:true. That means this is not unauthenticated internet-wide spray-and-pray exploitation in the simplest sense. But it is still high risk because the privileges required are low, no user interaction is needed, and exploitation is possible over the network.

Technical Notes

// Vulnerability mechanics summarized from public descriptions
// User-controlled template parameters were rendered into dialplan output
// and written to extensions_custom.conf before version 1.6.2.

fm_dialplan_apply(
  greeting,
  dest,
  url,
  extension,
  code,
  file,
  confirm=true
);

; Examples of dangerous Asterisk primitives explicitly mentioned in advisories
same => n,System(/bin/sh -c 'id')
same => n,Set(cmd=${SHELL(/usr/bin/whoami)})
same => n,Goto(malicious-context,s,1)
same => n,Macro(unauthorized-flow)
AnalystImpact · assess the risk

Who Is Affected?

The affected product is Frogman. The affected version range, based on the NVD record, is all versions prior to 1.6.2. The fixed version is 1.6.2. If you are running 1.6.1 or any earlier release, you should assume the instance is vulnerable unless you have independently backported the vendor’s fix and verified it in code.

The exposure is most relevant to organizations that actively use Frogman to manage PBX dialplan behavior through MCP or HTTP API workflows. Environments with delegated administration, automation accounts, or multiple operators are at greater risk because the attack requires an authenticated caller with PERM_WRITE. If your deployment model grants broad write access for convenience, the practical attack surface is wider than the CVE might initially suggest.

Because the vulnerable behavior writes to extensions_custom.conf, organizations using Asterisk-based workflows or custom dialplan management should treat this as both an application-layer and telephony-layer risk. Even if an attacker cannot reach full OS command execution in your specific setup, arbitrary dialplan injection can still enable toll fraud, call interception, unauthorized call forwarding, denial of service, or persistence through modified call logic.

If you do not know your exact Frogman version, defenders should assume exposure until proven otherwise. In the absence of inventory clarity, verify the installed version from the application package metadata, deployment manifests, container tags, or GitHub release alignment.

Technical Notes

# Example checks to identify deployed version
frogman --version

# If deployed from a git checkout
git describe --tags

# If running in a container, inspect image tag or build metadata
docker ps --format "table {{.Names}}    {{.Image}}"
docker inspect <container_id> | grep -i '"Image"
|"Env"' -n

CVSS Score Breakdown

The CVSS v3.1 base score is 9.9 Critical with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. This score reflects a bug that is reachable over the network, has low attack complexity, requires only low privileges, and needs no user interaction. For defenders, that combination usually means exploitation is operationally feasible once an attacker has access to a valid low-privileged account or token.

The S:C or scope changed component is especially important here. It indicates the vulnerable component can impact resources beyond its original security boundary. In practical terms, a write-capable user of the Frogman application can influence Asterisk dialplan execution and potentially host-level actions through dialplan primitives. That cross-boundary effect is why this issue scores near the top of the CVSS range despite requiring authentication.

The confidentiality, integrity, and availability impacts are all rated high. That is consistent with the likely outcomes of arbitrary dialplan injection. Confidentiality risks can include unauthorized call handling or data exposure through manipulated call flows. Integrity impact is obvious because the attacker can modify call behavior. Availability impact is also significant because malformed or hostile dialplan entries can break telephony operations or intentionally disrupt routing.

One caveat for practitioners: CVSS does not capture all environment-specific realities. In a tightly controlled deployment with highly restricted PERM_WRITE assignment and no exposure of the management API, your practical risk may be somewhat lower. In a multi-tenant, internet-reachable, or loosely governed PBX management environment, the effective risk may be even higher than the score suggests.

Exploitation Status

As of the research context provided, there is no confirmed public evidence of active exploitation in the wild. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing. That means there is currently no CISA-backed indication of observed exploitation activity.

There is also no clearly verified public proof-of-concept exploit identified in the provided primary-source material. However, defenders should not mistake the absence of a public PoC for low exploitability. The public technical description is already detailed enough to enable exploit development by a capable attacker. The vulnerable code path, the relevant parameters, the output file, the permission requirement, and examples of dangerous directives are all disclosed.

In practical risk terms, this places the issue in a common but dangerous category: no confirmed mass exploitation yet, but enough information is public that exploit creation is plausible and likely straightforward for someone familiar with Asterisk and the application code path. Organizations that expose Frogman management surfaces or grant PERM_WRITE broadly should not wait for KEV inclusion before patching.

If your team requires a concise status statement for operations or management: exploitation in the wild is not confirmed, a public PoC is not confirmed, and defenders should assume exploitation is feasible because technical details are already public.

ResponderRunbook · act now

How to Detect It

Detection should focus on two places: use of the Frogman dialplan-apply workflow and unauthorized modifications to extensions_custom.conf. Because the NVD says exploitation requires confirm:true and PERM_WRITE, requests or actions that combine those conditions deserve immediate scrutiny. If your application logs record API method names, user IDs, payload fields, or confirmation flags, search for recent uses of fm_dialplan_apply, especially from unexpected users or source IPs.

At the PBX layer, defenders should inspect extensions_custom.conf and surrounding dialplan files for suspicious directives that do not align with your approved templates. The most important strings to hunt for are the directive families named in the public advisory: System(, SHELL(, Goto(, and Macro(. Also look for newly introduced contexts, unexplained call redirections, or dialplan lines added outside normal change windows.

If your logging is limited and you cannot confirm exploitation directly, treat unexplained dialplan changes as suspicious until reviewed. In many SMB and mid-market telephony environments, application auditing is weaker than system auditing. In that case, file integrity monitoring and Asterisk configuration review may provide the most reliable path to detection.

Technical Notes

# Hunt for risky dialplan primitives in custom configuration
grep -RniE 'System\(|SHELL\(|Goto\(|Macro\(' /etc/asterisk/extensions_custom.conf /etc/asterisk/

# Review recent changes if file timestamps are meaningful
ls -l --time-style=long-iso /etc/asterisk/extensions_custom.conf
stat /etc/asterisk/extensions_custom.conf

-- Example detection query for application/API logs if fields are structured
SELECT timestamp, user, src_ip, action, request_body
FROM frogman_api_logs
WHERE action = 'fm_dialplan_apply'
  AND request_body LIKE '%confirm:true%';

index=frogman OR index=pbx
("fm_dialplan_apply" AND "confirm:true")
OR ("extensions_custom.conf" AND ("System(" OR "SHELL(" OR "Goto(" OR "Macro("))

rule Suspicious_Asterisk_Dialplan_Injection
{
  strings:
    $s1 = "System("
    $s2 = "SHELL("
    $s3 = "Goto("
    $s4 = "Macro("
  condition:
    any of them
}

A useful operational check is to compare the current extensions_custom.conf against a known-good baseline from version control or configuration backups. In telephony environments, even a single unauthorized directive can have meaningful impact.

Mitigation and Patching

The primary mitigation is to upgrade Frogman to version 1.6.2 or later. The NVD and the associated GitHub Security Advisory both state that the issue is fixed in 1.6.2. If you are on any version prior to 1.6.2, you should prioritize this update. There is no reason to remain on a vulnerable release if direct upgrade is operationally possible.

In parallel with patching, review all users, roles, tokens, and automation that have PERM_WRITE. Because exploitation requires that permission, reducing its assignment can immediately lower exposure. Restrict network access to the Frogman HTTP API and associated management interfaces to trusted administrative networks or VPNs. If your deployment allows it, require tighter authentication controls and monitor for configuration change events.

If you cannot patch immediately, apply compensating controls. These should include disabling or restricting access to dialplan-apply functionality where feasible, reducing PERM_WRITE assignments to the minimum necessary, and implementing file integrity monitoring on extensions_custom.conf. Also conduct a retroactive review of dialplan changes for persistence or tampering before and after applying the update.

Technical Notes

# If deploying from the upstream git repository
git fetch --tags
git checkout v1.6.2

# Verify selected version
git describe --tags

# Example container-oriented workflow if your deployment pins image tags
docker pull ghcr.io/mwtcmi/frogman:1.6.2
docker stop frogman
docker rm frogman
docker run -d --name frogman ghcr.io/mwtcmi/frogman:1.6.2

# Immediate workaround actions if patching must wait
# 1) Back up dialplan config
cp /etc/asterisk/extensions_custom.conf /root/extensions_custom.conf.bak.$(date +%F)

# 2) Remove unneeded write-capable access in your IAM or app config process
# Exact command is deployment-specific and not documented in the public advisory.

# 3) Monitor file changes
auditctl -w /etc/asterisk/extensions_custom.conf -p wa -k frogman_dialplan_watch
ausearch -k frogman_dialplan_watch

Because the public advisory does not document a vendor-provided temporary configuration toggle, defenders should assume no official workaround is available beyond upgrading and restricting access. If your deployment is heavily customized, validate after upgrade that template rendering no longer permits unsafe directive injection.

References

The most authoritative source is the NVD entry for CVE-2026-46512, which provides the official description, CVSS vector, affected version statement, and the high-level technical details of the flaw. The GitHub Security Advisory and upstream release information provide project-level confirmation of the fixed version and patch availability.

Use the references below for validation, change management, and internal advisory work. If new information later appears regarding active exploitation or a public PoC, your detection and response priorities should be updated accordingly.

For additional insights, consider reviewing our articles on comparing the best backup solutions for ransomware recovery and what is a bootkit.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.

Last verified: 2026-07-23

Disclaimer: This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.