CVE-2019-10655

🗓️ 30 Mar 2019 16:42:06Reported by mitreType

cve🔗 web.nvd.nist.gov👁 210 Views🌐 WEB

CVE-2019-10655 Grandstream GAC2500 1.0.3.35, GXP2200 1.0.3.27, GVC3202 1.0.3.51, GXV3275 before 1.0.3.219 Beta, and GXV3240 before 1.0.3.219 Beta devices allow unauthenticated remote code execution via shell metacharacters

Reporter	Title	Published	Views	Family All 23
0day.today	Grandstream GXV3175 Unauthenticated Command Execution Exploit	20 Jan 202200:00	–	zdt
0day.today	Grandstream GXV31XX settimezone Unauthenticated Command Execution Exploit	9 Feb 202200:00	–	zdt
Tenable Nessus	Grandstream GXV3240 < 1.0.3.219 RCE	5 Apr 201900:00	–	nessus
Tenable Nessus	Grandstream GXV3275 < 1.0.3.219 RCE	5 Apr 201900:00	–	nessus
Tenable Nessus	Multiple Command Injection Vulnerabilities in Grandstream Products	1 Apr 201900:00	–	nessus
Tenable Nessus	Multiple Command Injection Vulnerabilities in Grandstream Products	19 Apr 201900:00	–	nessus
ATTACKERKB	CVE-2019-10655	30 Mar 201900:00	–	attackerkb
Circl	CVE-2019-10655	15 Oct 202015:07	–	circl
Check Point Advisories	Grandstream Multiple Products Authentication Bypass (CVE-2019-10655)	25 Jan 202100:00	–	checkpoint_advisories
Cvelist	CVE-2019-10655	30 Mar 201916:42	–	cvelist

NVD

Node

grandstream gac2500_firmwareRange≤1.0.3.35

AND

grandstream gac2500Match-

Node

grandstream gvc3202_firmwareRange<1.0.3.51

AND

grandstream gvc3202Match-

Node

grandstream gxv3275_firmwareRange<1.0.3.219

AND

grandstream gxv3275Match-

Node

grandstream gxv3240_firmwareRange<1.0.3.219

AND

grandstream gxv3240Match-

Node

grandstream gxp2200_firmwareRange≤1.0.3.27

AND

grandstream gxp2200Match-

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/165643/Grandstream-GXV3175-Unauthenticated-Command-Execution.html
github	www.github.com/scarvell/grandstream_exploits
packetstormsecurity	www.packetstormsecurity.com/files/165931/Grandstream-GXV31XX-settimezone-Unauthenticated-Command-Execution.html
trustwave	www.trustwave.com/en-us/resources/security-resources/security-advisories/

Parameter	Position	Path	Description	CWE
action	query param	/manager	Unauthenticated remote code execution via crafted input in /manager (action and timezone) potentially combined with cookie-based bypass.	CWE-119, CWE-352, CWE-78
timezone	query param	/manager	Unauthenticated remote code execution via crafted input in /manager (action and timezone) potentially combined with cookie-based bypass.	CWE-119, CWE-352, CWE-78

21 Nov 2024 04:19Current

10High risk

Vulners AI Score10

CVSS 27.5

CVSS 3.19.8

EPSS0.72438

cve 2019 10655 grandstream gac2500 gxp2200 gvc3202 gxv3275 gxv3240 remote code execution shell metacharacters unauthenticated buffer overflow csrf lighttpd