Grandstream vulnerabilities, page 3

57 vulnerabilities

Known vulnerabilities in Grandstream products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 64 products.

9.8CriticalCVE-2022-2070grandstream · gds3710_firmware +1 moreGrandstream GSD3710 Stack-based Buffer OverflowIn Grandstream GSD3710 in its 1.0.11.13 version, it's possible to overflow the stack since it doesn't check the param length before using the sscanf instruction. Because of that, an attacker could create a socket and connect with a remote IP:port by opening a shell and getting full access to the system. The exploit affects daemons dbmng and logsrv that are running on ports 8000 and 8001 by default.EPSS5.84%8HighCVE-2017-16563grandstream · ht802_firmwaregrandstream ht802_firmwareCross-Site Request Forgery (CSRF) in the Basic Settings screen on Vonage (Grandstream) HT802 devices allows attackers to modify settings, related to cgi-bin/update.EPSS0.44%8.8HighCVE-2017-16565grandstream · ht802_firmwaregrandstream ht802_firmwareCross-Site Request Forgery (CSRF) in /cgi-bin/login on Vonage (Grandstream) HT802 devices allows attackers to authenticate a user via the login screen using the default password of 123 and submit arbitrary requests.EPSS0.49%5.4MediumCVE-2017-16564grandstream · ht802_firmwaregrandstream ht802_firmwareStored Cross-site scripting (XSS) vulnerability in /cgi-bin/config2 on Vonage (Grandstream) HT802 devices allows remote authenticated users to inject arbitrary web script or HTML via the DHCP vendor class ID field (P148).EPSS0.61%8.8HighCVE-2024-0840grandstream · ucm seriesGrandstream UCM Series IP PBX HTTP Parameter InjectionThe Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP request. Authentication may be possible using a default user and password. Affected models are the UCM6202, UCM6204, UCM6208, and UCM6510.EPSS0.88%9.8CriticalCVE-2024-32937grandstream · gxp2135_firmwaregrandstream gxp2135_firmwareAn os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of Grandstream GXP2135 1.0.9.129, 1.0.11.74 and 1.0.11.79. A specially crafted network packet can lead to arbitrary command execution. An attacker can send a sequence of malicious packets to trigger this vulnerability.EPSS26.96%9.8CriticalCVE-2019-10655grandstream · gac2500_firmware +4 moregrandstream gac2500_firmwareGrandstream GAC2500 1.0.3.35, GXP2200 1.0.3.27, GVC3202 1.0.3.51, GXV3275 before 1.0.3.219 Beta, and GXV3240 before 1.0.3.219 Beta devices allow unauthenticated remote code execution via shell metacharacters in a /manager?action=getlogcat priority field, in conjunction with a buffer overflow (via the phonecookie cookie) to overwrite a data structure and consequently bypass authentication. This can be exploited remotely or via CSRF because the cookie can be placed in an Accept HTTP header in an XMLHttpRequest call to lighttpd.EPSS15.47%10CriticalCVE-2019-10661grandstream · gxv3611ir_hd_firmwaregrandstream gxv3611ir_hd_firmwareOn Grandstream GXV3611IR_HD before 1.0.3.23 devices, the root account lacks a password.EPSS1.79%6.5MediumCVE-2019-10657grandstream · gwn7000_firmware +1 moregrandstream gwn7000_firmwareGrandstream GWN7000 before 1.0.6.32 and GWN7610 before 1.0.8.18 devices allow remote authenticated users to discover passwords via a /ubus/uci.apply config request.EPSS1.46%8.8HighCVE-2019-10663grandstream · ucm6204_firmwaregrandstream ucm6204_firmwareGrandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to conduct SQL injection attacks via the sord parameter in a listCodeblueGroup API call to the /cgi? URI.EPSS27.88%8.8HighCVE-2019-10659grandstream · gxv3370_firmware +1 moregrandstream gxv3370_firmwareGrandstream GXV3370 before 1.0.1.41 and WP820 before 1.0.3.6 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in a /manager?action=getlogcat priority field.EPSS2.62%8.8HighCVE-2019-10658grandstream · gwn7610_firmwaregrandstream gwn7610_firmwareGrandstream GWN7610 before 1.0.8.18 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the filename in a /ubus/controller.icc.update_nds_webroot_from_tmp update_nds_webroot_from_tmp API call.EPSS2.64%9CriticalCVE-2019-10656grandstream · gwn7000_firmwaregrandstream gwn7000_firmwareGrandstream GWN7000 before 1.0.6.32 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the filename in a /ubus/uci.apply update_nds_webroot_from_tmp API call.EPSS3.91%8.8HighCVE-2019-10660grandstream · gxv3611ir_hd_firmwaregrandstream gxv3611ir_hd_firmwareGrandstream GXV3611IR_HD before 1.0.3.23 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the /goform/systemlog?cmd=set logserver field.EPSS2.64%9CriticalCVE-2019-10662grandstream · ucm6204_firmwaregrandstream ucm6204_firmwareGrandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the backupUCMConfig file-backup parameter to the /cgi? URI.EPSS43.86%9.8CriticalCVE-2026-2329grandstream · gxp1610_firmware +5 moreGrandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflowAn unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote code execution (RCE) with root privileges on a target device. The vulnerability affects all six device models in the series: GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630.EPSS41.72%7.8HighCVE-2006-5231grandstream · gxp-2000grandstream gxp-2000Grandstream GXP-2000 VoIP Desktop Phone, firmware version 1.1.0.5, allows remote attackers to cause a denial of service (hang or reboot) via a large amount of ASCII data sent to port (1) 5060/UDP, (2) 5062/UDP, (3) 5064/UDP, (4) 5066/UDP, (5) 9876/UDP, or (6) 26789/UDP.EPSS2.06%