586 matches found
CVE-2024-32937
An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of Grandstream GXP2135 1.0.9.129, 1.0.11.74 and 1.0.11.79. A specially crafted network packet can lead to arbitrary command execution. An attacker can send a sequence of malicious packets to trigger this...
CVE-2024-32937
An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of Grandstream GXP2135 1.0.9.129, 1.0.11.74 and 1.0.11.79. A specially crafted network packet can lead to arbitrary command execution. An attacker can send a sequence of malicious packets to trigger this...
Grandstream GXP2135 Operating System Command Injection Vulnerability
The Grandstream GXP2135 is an enterprise-grade color screen IP phone from Grandstream. An operating system command injection vulnerability exists in the Grandstream GXP2135 versions 1.0.9.129, 1.0.11.74, and 1.0.11.79, which originates from specially crafted network packets that can lead to...
PT-2024-24989
Name of the Vulnerable Software and Affected Versions Grandstream GXP2135 versions 1.0.9.129 through 1.0.11.79 Description An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality. A specially crafted network packet can lead to arbitrary command execution. An...
CVE-2024-32937: Improper Neutralization of Special Elements used in an OS Command
An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of Grandstream GXP2135 1.0.9.129, 1.0.11.74 and 1.0.11.79. A specially crafted network packet can lead to arbitrary command execution. An attacker can send a sequence of malicious packets to trigger this...
Grandstream GXP2135 CWMP SelfDefinedTimeZone OS command injection vulnerability
Talos Vulnerability Report TALOS-2024-1978 Grandstream GXP2135 CWMP SelfDefinedTimeZone OS command injection vulnerability July 3, 2024 CVE Number CVE-2024-32937 SUMMARY An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of Grandstream GXP2135 1.0.9.129,...
CVE-2024-0840 Grandstream UCM Series IP PBX HTTP Parameter Injection
The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP request. Authentication may be possible using a default user and...
CVE-2024-0840
CVE-2024-0840 affects Grandstream UCM Series IP PBX firmwares prior to 1.0.20.52 (UCM6202/6204/6208/6510). A parameter injection vulnerability in the HTTP interface allows a remote, authenticated attacker to execute arbitrary code by sending a crafted HTTP request; authentication may be possible ...
CVE-2024-0840 Grandstream UCM Series IP PBX HTTP Parameter Injection
The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP request. Authentication may be possible using a default user and...
CVE-2024-0840: Improper Neutralization of Parameter/Argument Delimiters
The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP request. Authentication may be possible using a default user and...
Grandstream UCM Series IP PBX 安全漏洞
The Grandstream UCM Series is a series of IP PBX devices from Grandstream. A security vulnerability exists in the Grandstream UCM Series IP PBX prior to firmware version 1.0.20.52, which originates from a vulnerability that allows an authenticated remote attacker to execute arbitrary code by...
PT-2024-15859 · Grandstream · Grandstream Ucm Series Ip Pbx
Name of the Vulnerable Software and Affected Versions: Grandstream UCM Series IP PBX versions prior to 1.0.20.52 Description: The issue is related to a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP...
Grandstream IP Phones GXP14xx <= 1.0.8.9 / GXP16xx <= 1.0.7.70 Privilege Escalation Vulnerability (GSVUL-2023-001)
Grandstream GXP14xx and GXP16xx Series IP phones are prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
CVE-2023-50015
An issue was discovered in Grandstream GXP14XX 1.0.8.9 and GXP16XX 1.0.7.13, allows remote attackers to escalate privileges via incorrect access control using an end-user session-identity token...
Design/Logic Flaw
An issue was discovered in Grandstream GXP14XX 1.0.8.9 and GXP16XX 1.0.7.13, allows remote attackers to escalate privileges via incorrect access control using an end-user session-identity token...
CVE-2023-50015
An issue was discovered in Grandstream GXP14XX 1.0.8.9 and GXP16XX 1.0.7.13, allows remote attackers to escalate privileges via incorrect access control using an end-user session-identity token...
CVE-2023-50015: Execution with Unnecessary Privileges
An issue was discovered in Grandstream GXP14XX 1.0.8.9 and GXP16XX 1.0.7.13, allows remote attackers to escalate privileges via incorrect access control using an end-user session-identity token...
CVE-2023-50015
An issue was discovered in Grandstream GXP14XX 1.0.8.9 and GXP16XX 1.0.7.13, allows remote attackers to escalate privileges via incorrect access control using an end-user session-identity token...
Grandstream GXP14XX and GXP16XX Security Vulnerabilities
The Grandstream GXP14XX and Grandstream GXP16XX are both a series of IP phones from American Trend Networks Grandstream. A security vulnerability exists in the Grandstream GXP14XX version 1.0.8.9 and GXP16XX version 1.0.7.13, which originates from a vulnerability that allows a remote attacker to...
CVE-2023-50015
Grandstream GXP14XX (version 1.0.8.9) and GXP16XX (version 1.0.7.13) IP phones are susceptible to a privilege escalation vulnerability. The root cause is incorrect access control involving an end-user session-identity token , which allows remote attackers to escalate privileges. As of the latest ...