CyberRota Analysis
AI-GeneratedFrogman versions prior to 1.6.2 are vulnerable due to the exposure of plaintext passwords and secrets through specific API endpoints, which can be accessed by any user with read permissions. This flaw allows unauthorized retrieval of sensitive credentials, potentially compromising the security of the PBX system. Organizations using affected versions should prioritize upgrading to 1.6.2 to mitigate the risk of credential theft.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, fm_reset_password in Tools/ResetPassword.php:48-53 returned a plaintext password and fm_add_extension in Tools/AddExtension.php:172 returned a plaintext secret; Frogman.class.php:2207-2211 used auditOutcome to JSON-encode those responses into oc_audit_log.detail, allowing any PERM_READ caller with access to fm_audit_search to recover the stored credentials. This issue is fixed in version 1.6.2.