Lucene search

TenableCVE-2020-5756

HistoryJul 17, 2020 - 9:15 p.m.

CVE-2020-5756

2020-07-1721:15:13

CWE-78

CWE-489

tenable

web.nvd.nist.gov

cve-2020-5756

grandstream

gwn7000

firmware

remote users

crontab

undocumented api

os commands

router

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.013

Percentile

86.4%

JSON

Grandstream GWN7000 firmware version 1.0.9.4 and below allows authenticated remote users to modify the system’s crontab via undocumented API. An attacker can use this functionality to execute arbitrary OS commands on the router.

Affected configurations

Nvd

Node

grandstreamgwn7000_firmwareRange≤1.0.9.4

AND

grandstreamgwn7000Match-

VendorProductVersionCPE
grandstreamgwn7000_firmware*cpe:2.3:o:grandstream:gwn7000_firmware:*:*:*:*:*:*:*:*
grandstreamgwn7000-cpe:2.3:h:grandstream:gwn7000:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
grandstream	gwn7000_firmware	*	cpe:2.3:o:grandstream:gwn7000_firmware::::::::
grandstream	gwn7000	-	cpe:2.3:h:grandstream:gwn7000:-:::::::*

CNA Affected

[
  {
    "product": "Grandstream GWN7000",
    "vendor": "Tenable",
    "versions": [
      {
        "status": "affected",
        "version": "Versions 1.0.9.4 and below"
      }
    ]
  }
]

References

www.tenable.com/cve/CVE-2020-5756

www.tenable.com/security/research/tra-2020-41

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.013

Percentile

86.4%

JSON

Related for CVE-2020-5756