Logo
Retour à la veille

CVE-2026-46515

Publié : 16 juillet 2026
Modifié : 16 juillet 2026
Lien officiel NVD

Description détaillée

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERM_READ access was sufficient to call fm_list_managers, fm_list_pinsets, fm_show_context, fm_get_mcp_config, fm_backup_status, fm_whos_calling, fm_run_saved_query, and fm_diagnose_trunk, exposing AMI manager secrets, outbound dial PINs, full Asterisk dialplan context, root SSH connection commands, backup artifact paths, CDR history, arbitrary saved GraphQL query execution, and raw AMI endpoint dumps containing SIP fields such as password, md5_cred, and oauth_secret. This issue is fixed in version 1.6.3.

Références et Patchs

https://github.com/mwtcmi/frogman/commit/55ea257d5c24bc01c814a607faa7e76e86b111echttps://github.com/mwtcmi/frogman/commit/b8a8bfc12b564bcb77caef952873b9ffd4a98b00https://github.com/mwtcmi/frogman/issues/13https://github.com/mwtcmi/frogman/issues/25https://github.com/mwtcmi/frogman/releases/tag/v1.6.3https://github.com/mwtcmi/frogman/security/advisories/GHSA-q4c4-5cr4-8q47

Dernières Vulnérabilités

CVE-2026-61378

A divide-by-zero vulnerability in the Productivity Suite allows a local attacker to cause a division by zero leading to a system crash.

VOIR DÉTAILS

CVE-2026-60073

An out-of-bounds read in the Productivity Suite allows a physical attacker to control the length of data sent to a USB device. This can lead to a system crash or disclosure of kernel memory.

VOIR DÉTAILS

CVE-2026-57896

An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This could lead to limited information disclosure or disruption of the affected product.

VOIR DÉTAILS