CVE-2020-5756

2020-07-1720:16:27

CWE-489

tenable

www.cve.org

grandstream gwn7000

firmware version

authenticated remote users

crontab modification

undocumented api

arbitrary os commands

router security

AI Score

8.9

Confidence

High

EPSS

0.013

Percentile

86.4%

JSON

Grandstream GWN7000 firmware version 1.0.9.4 and below allows authenticated remote users to modify the system’s crontab via undocumented API. An attacker can use this functionality to execute arbitrary OS commands on the router.

CNA Affected

[
  {
    "product": "Grandstream GWN7000",
    "vendor": "Tenable",
    "versions": [
      {
        "status": "affected",
        "version": "Versions 1.0.9.4 and below"
      }
    ]
  }
]

References

www.tenable.com/security/research/tra-2020-41