CVE-2021-37915: grandstream ht801_firmware
Vulnerability summary
CVE-2021-37915 is a high (CVSS 9.0) vulnerability in grandstream ht801_firmware. EPSS estimates a 2.03% chance of exploitation in the next 30 days, higher than 80.8% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 28-10-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered on the Grandstream HT801 Analog Telephone Adaptor before 1.0.29.8. From the limited configuration shell, it is possible to set the malicious gdb_debug_server variable. As a result, after a reboot, the device downloads and executes malicious scripts from an attacker-defined host.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
2.03%
Chance of exploitation in the next 30 days
Percentile
81%
Versus all other CVEs
30-day change
0.00 pp
From 2.03% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (secforce.com)
Maturity: unknown
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Grandstream1 product
- ht801_firmware< 1.0.29.8
1 vendor · 1 product
References
3 links- www.grandstream.com/products/gateways-and-atas/analog-telephone-adaptors/product/ht801X Refsource MISCProductVendor Advisory
- www.secforce.com/blog/exploiting-grandstream-ht801-ata-cve-2021-37748-cve-2021-37915/X Refsource MISCExploitThird Party Advisory