CyberRota Analysis
AI-GeneratedFrogman versions prior to 1.6.3 are vulnerable due to insufficient access controls, allowing users with PERM_READ access to exploit multiple API endpoints. This can lead to the exposure of sensitive information, including AMI manager secrets, outbound dial PINs, and raw SIP credentials, posing significant risks to system integrity and confidentiality. Organizations using affected versions should prioritize upgrading to 1.6.3 to mitigate potential data breaches and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERM_READ access was sufficient to call fm_list_managers, fm_list_pinsets, fm_show_context, fm_get_mcp_config, fm_backup_status, fm_whos_calling, fm_run_saved_query, and fm_diagnose_trunk, exposing AMI manager secrets, outbound dial PINs, full Asterisk dialplan context, root SSH connection commands, backup artifact paths, CDR history, arbitrary saved GraphQL query execution, and raw AMI endpoint dumps containing SIP fields such as password, md5_cred, and oauth_secret. This issue is fixed in version 1.6.3.