Grandstream GXV3611IR_HD Trust Management Issues Vulnerability

The Grandstream GXV3611IRHD is a webcam from Grandstream. A security vulnerability exists in Grandstream GXV3611IRHD versions prior to 1.0.3.23. An attacker can exploit the default password or hard-coded passwords, hard-coded certificates, etc. to attack the affected components...

CVE-2018-17564

A Malformed Input String to /cgi-bin/deleteCA on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to delete configuration parameters and gain admin access to the device...

CVE-2018-17565

Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute arbitrary system commands and gain a root shell...

CVE-2018-17565

Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute arbitrary system commands and gain a root shell...

CVE-2018-17564

A Malformed Input String to /cgi-bin/deleteCA on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to delete configuration parameters and gain admin access to the device...

CVE-2018-17563

A Malformed Input String to /cgi-bin/api-getlinestatus on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to dump the device's configuration in cleartext...

CVE-2018-17563

A Malformed Input String to /cgi-bin/api-getlinestatus on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to dump the device's configuration in cleartext...

Input validation

A Malformed Input String to /cgi-bin/deleteCA on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to delete configuration parameters and gain admin access to the device...

Input validation

A Malformed Input String to /cgi-bin/api-getlinestatus on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to dump the device's configuration in cleartext...

Design/Logic Flaw

Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute arbitrary system commands and gain a root shell...

CVE-2018-17565

The CVE-2018-17565 entry concerns a Shell Metacharacter Injection vulnerability in the SSH configuration interface of Grandstream GXP16xx VoIP phones (firmware 1.0.4.128). The vulnerability allows an attacker to execute arbitrary system commands and obtain a root shell. Public documents identify ...

CVE-2018-17565

Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute arbitrary system commands and gain a root shell...

CVE-2018-17564

A Malformed Input String to /cgi-bin/deleteCA on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to delete configuration parameters and gain admin access to the device...

CVE-2018-17564

The CVE-2018-17564 issue affects Grandstream GXP16xx VoIP phones (e.g., 1.0.4.128). A malformed input string to /cgi-bin/delete_CA allows an attacker to delete configuration parameters and gain administrator access. Root cause: input validation flaw at the /cgi-bin/delete_CA endpoint. Impact: par...

CVE-2018-17563

A Malformed Input String to /cgi-bin/api-getlinestatus on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to dump the device's configuration in cleartext...

CVE-2018-17563

The CVE-2018-17563 vulnerability affects Grandstream GXP16xx VoIP phones (example 1.0.4.128). A malformed input string to /cgi-bin/api-get_line_status allows an attacker to dump the device configuration in plaintext, constituting an information disclosure issue. The root cause is a malformed inpu...

Multiple Command Injection Vulnerabilities in Grandstream Products

Multiple Vulnerabilities in Grandstream devices. - The affected devices are: GAC2500, GVC3202, GXP2200, GXV3275, GXV3240, GXV3611IRHD, GXV3611IRHD, GXV3611IRHD, UCM6204, GXV3370, WP820, GWN7000, & GWN7610. - A remote command execution vulnerability exists in the 'priority' and 'logserver'...

CVE-2019-10655

Grandstream GAC2500 1.0.3.35, GXP2200 1.0.3.27, GVC3202 1.0.3.51, GXV3275 before 1.0.3.219 Beta, and GXV3240 before 1.0.3.219 Beta devices allow unauthenticated remote code execution via shell metacharacters in a /manager?action=getlogcat priority field, in conjunction with a buffer overflow via...

Code injection

Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the backupUCMConfig file-backup parameter to the /cgi? URI...

Code injection

Grandstream GWN7000 before 1.0.6.32 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the filename in a /ubus/uci.apply updatendswebrootfromtmp API call...