CVE-2020-5756: Active Debug Code

Grandstream GWN7000 firmware version 1.0.9.4 and below allows authenticated remote users to modify the system's crontab via undocumented API. An attacker can use this functionality to execute arbitrary OS commands on the router...

Grandstream GXP1600 Code Injection Vulnerability

The Grandstream GXP1600 is an IP phone product from Grandstream. A code injection vulnerability exists in the Grandstream GXP1600 series using firmware version 1.0.4.152 and earlier. The vulnerability can be exploited to add arbitrary OpenVPN configuration settings to a configuration file with th...

Grandstream GXP1600 Backlink Vulnerability

The Grandstream GXP1600 is an IP phone product from Grandstream. A backlink vulnerability exists in the Grandstream GXP1600 series using firmware version 1.0.4.152 and earlier. The vulnerability can be exploited to execute arbitrary scripts and gain root privileges by uploading a specially crafte...

Grandstream GXP IP Phone Detection (SIP)

SIP based detection of Grandstream GXP IP phones. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Grandstream GXP IP Phone Detection (Telnet)

Telnet based detection of Grandstream GXP IP phones. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Grandstream GXP IP Phone Detection Consolidation

Consolidation of Grandstream GXP IP phone detections. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Grandstream GXP1600 Series IP Phones <= 1.0.4.152 Multiple RCE Vulnerabilities

Grandstream GXP1600 Series IP Phones are prone to multiple remote code execution RCE vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CVE-2020-5739

Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker adds an OpenVPN up script to the phone's VPN settings via the "Additional Settings" field in the web interface. When the VPN's connection is established, the user defin...

CVE-2020-5739

Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker adds an OpenVPN up script to the phone's VPN settings via the "Additional Settings" field in the web interface. When the VPN's connection is established, the user defin...

CVE-2020-5738

Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker uploads a specially crafted tar file to the HTTP /cgi-bin/uploadvpntar interface...

CVE-2020-5738

Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker uploads a specially crafted tar file to the HTTP /cgi-bin/uploadvpntar interface...

Design/Logic Flaw

Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker uploads a specially crafted tar file to the HTTP /cgi-bin/uploadvpntar interface...

Design/Logic Flaw

Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker adds an OpenVPN up script to the phone's VPN settings via the "Additional Settings" field in the web interface. When the VPN's connection is established, the user defin...

CVE-2020-5739

Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker adds an OpenVPN up script to the phone's VPN settings via the "Additional Settings" field in the web interface. When the VPN's connection is established, the user defin...

CVE-2020-5738

Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker uploads a specially crafted tar file to the HTTP /cgi-bin/uploadvpntar interface...

CVE-2020-5739

Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker adds an OpenVPN up script to the phone's VPN settings via the "Additional Settings" field in the web interface. When the VPN's connection is established, the user defin...

CVE-2020-5739

Affected product: Grandstream GXP1600 series firmware

CVE-2020-5738

The CVE-2020-5738 entry concerns Grandstream GXP1600 series firmware 1.0.4.152 and earlier. Affects the device via the HTTP endpoint /cgi-bin/upload_vpntar, where an attacker must be authenticated to upload a specially crafted tar file, leading to remote command execution on the affected system. ...

CVE-2020-5738

Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker uploads a specially crafted tar file to the HTTP /cgi-bin/uploadvpntar interface...

PT-2020-18660

Name of the Vulnerable Software and Affected Versions Grandstream GXP1600 series firmware versions 1.0.4.152 and below Description The issue allows for authenticated remote command execution when an attacker uploads a specially crafted tar file to the HTTP /cgi-bin/upload vpntar interface...