CVE-2022-2025: grandstream gds3710_firmware Stack-based Buffer Overflow
Vulnerability summary
CVE-2022-2025 is a critical (CVSS 9.8) Stack-based Buffer Overflow vulnerability in grandstream gds3710_firmware. EPSS estimates a 5.45% chance of exploitation in the next 30 days, higher than 92.7% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 23-09-2022PublishedVulnerability first disclosed.
- 22-05-2025Last modifiedVulnerability information updated.
Description
an attacker with knowledge of user/pass of Grandstream GSD3710 in its 1.0.11.13 version, could overflow the stack since it doesn't check the param length before use the strcopy instruction. The explotation of this vulnerability may lead an attacker to execute a shell with full access.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
5.45%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
+0.13 pp
From 5.33% on 22-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundGrandstream GSD3710 1.0.11.13 - Stack Overflow
Maturity: poc
Weaknesses
CWE · root cause- CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Grandstream2 products
- gds3710_firmware1.0.11.13
- grandstream gsd37101.0.11.13
1 vendor · 2 products