Command injection

Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. An authenticated remote attacker can bypass command injection mitigations and execute commands as the root user by sending a crafted HTTP POST to the UCM's "New" HTTPS API...

Command injection

Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. An authenticated remote attacker can execute commands as the root user by sending a crafted HTTP GET to the UCM's "Old" HTTPS API...

Command injection

Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via SSH. An authenticated remote attacker can execute commands as the root user by issuing a specially crafted "unset" command...

CVE-2020-5759

Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via SSH. An authenticated remote attacker can execute commands as the root user by issuing a specially crafted "unset" command...

CVE-2020-5759

The CVE-2020-5759 entry concerns Grandstream UCM6200 series firmware (versions 1.0.20.23 and earlier). The vulnerability is an OS command injection via SSH where an authenticated remote attacker can execute commands as the root user by sending a specially crafted unset command. This data is suppo...

CVE-2020-5758

Grandstream UCM6200 series firmware versions 1.0.20.23 and earlier are vulnerable to OS command injection via HTTP. An authenticated remote attacker can execute commands as root by sending a crafted HTTP GET to the UCM’s “Old” HTTPS API. Affected: UCM6200 series (firmware ≤1.0.20.23). Impact and ...

CVE-2020-5758

Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. An authenticated remote attacker can execute commands as the root user by sending a crafted HTTP GET to the UCM's "Old" HTTPS API...

CVE-2020-5757

Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. An authenticated remote attacker can bypass command injection mitigations and execute commands as the root user by sending a crafted HTTP POST to the UCM's "New" HTTPS API...

CVE-2020-5757

The CVE-2020-5757 entry affects Grandstream UCM6200 series firmware

CVE-2020-5756

Grandstream GWN7000 firmware version 1.0.9.4 and below allows authenticated remote users to modify the system's crontab via undocumented API. An attacker can use this functionality to execute arbitrary OS commands on the router...

CVE-2020-5756

Summary: CVE-2020-5756 affects Grandstream GWN7000, with firmware version 1.0.9.4 and older. An authenticated remote user can modify the system crontab via an undocumented API, enabling execution of arbitrary OS commands on the router. This vulnerability is described across multiple sources (NVD,...

Grandstream GXP1600 Backlink Vulnerability

The Grandstream GXP1600 is an IP phone product from Grandstream. A backlink vulnerability exists in the Grandstream GXP1600 series using firmware version 1.0.4.152 and earlier. The vulnerability can be exploited to execute arbitrary scripts and gain root privileges by uploading a specially crafte...

Grandstream GXP1600 Series IP Phones <= 1.0.4.152 Multiple RCE Vulnerabilities

Grandstream GXP1600 Series IP Phones are prone to multiple remote code execution RCE vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Grandstream GXP IP Phone Detection (SIP)

SIP based detection of Grandstream GXP IP phones. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Grandstream GXP1600 Code Injection Vulnerability

The Grandstream GXP1600 is an IP phone product from Grandstream. A code injection vulnerability exists in the Grandstream GXP1600 series using firmware version 1.0.4.152 and earlier. The vulnerability can be exploited to add arbitrary OpenVPN configuration settings to a configuration file with th...

Grandstream GXP IP Phone Detection Consolidation

Consolidation of Grandstream GXP IP phone detections. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Grandstream GXP IP Phone Detection (Telnet)

Telnet based detection of Grandstream GXP IP phones. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-5739

Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker adds an OpenVPN up script to the phone's VPN settings via the "Additional Settings" field in the web interface. When the VPN's connection is established, the user defin...

CVE-2020-5739

Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker adds an OpenVPN up script to the phone's VPN settings via the "Additional Settings" field in the web interface. When the VPN's connection is established, the user defin...

CVE-2020-5738

Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker uploads a specially crafted tar file to the HTTP /cgi-bin/uploadvpntar interface...