CVE-2019-10661

On Grandstream GXV3611IRHD before 1.0.3.23 devices, the root account lacks a password...

Default credentials

On Grandstream GXV3611IRHD before 1.0.3.23 devices, the root account lacks a password...

CVE-2019-10658

Grandstream GWN7610 before 1.0.8.18 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the filename in a /ubus/controller.icc.updatendswebrootfromtmp updatendswebrootfromtmp API call...

CVE-2019-10663

Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to conduct SQL injection attacks via the sord parameter in a listCodeblueGroup API call to the /cgi? URI...

CVE-2019-10663

Grandstream UCM6204 is affected by CVE-2019-10663. Before version 1.0.19.20, remote authenticated users can perform a SQL injection via the sord parameter in the listCodeblueGroup API call to the /cgi? URI. Impact details are described across multiple sources, with the vulnerability enabling unin...

CVE-2019-10662

Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the backupUCMConfig file-backup parameter to the /cgi? URI...

CVE-2019-10662

CVE-2019-10662 affects Grandstream UCM6204 devices running firmware prior to 1.0.19.20. The issue lets remote authenticated users execute arbitrary code via shell metacharacters in the backupUCMConfig file-backup parameter sent to the /cgi? URI. Root cause appears to be a command execution vulner...

CVE-2019-10661

On Grandstream GXV3611IRHD before 1.0.3.23 devices, the root account lacks a password...

CVE-2019-10661

CVE-2019-10661 affects Grandstream GXV3611IR_HD prior to version 1.0.3.23, where the root account has no password, enabling potential unauthorized access. Red Hat, CVE registries, and Nessus-related entries corroborate the vulerability: default/root password issue on affected GXV3611IR_HD devices...

CVE-2019-10660

The CVE-2019-10660 affects Grandstream GXV3611IR_HD devices, documented as vulnerable before firmware 1.0.3.23. A remote attacker with authentication can execute arbitrary code by supplying shell metacharacters in the logserver field of the /goform/systemlog API. The issue is a remote code execut...

CVE-2019-10660

Grandstream GXV3611IRHD before 1.0.3.23 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the /goform/systemlog?cmd=set logserver field...

CVE-2019-10659

Grandstream GXV3370 before 1.0.1.41 and WP820 before 1.0.3.6 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in a /manager?action=getlogcat priority field...

CVE-2019-10659

CVE-2019-10659 affects Grandstream GXV3370 (before 1.0.1.41) and WP820 (before 1.0.3.6). A remote authenticated attacker can execute arbitrary code by supplying shell metacharacters in the /manager?action=getlogcat priority parameter. Reported impact indicates remote code execution with at least ...

CVE-2019-10658

Grandstream GWN7610 before 1.0.8.18 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the filename in a /ubus/controller.icc.updatendswebrootfromtmp updatendswebrootfromtmp API call...

CVE-2019-10658

The CVE-2019-10658 issue affects Grandstream GWN7610 devices with firmware prior to 1.0.8.18. Affected component is the /ubus/controller.icc.update_nds_webroot_from_tmp API call, where an authenticated user can inject shell metacharacters via the filename parameter to execute arbitrary code on th...

CVE-2019-10657

Grandstream GWN7000 (pre-1.0.6.32) and GWN7610 (pre-1.0.8.18) are affected by CVE-2019-10657. Remote authenticated users can disclose passwords via a /ubus/uci.apply config request, enabling potential information disclosure. Root cause details are not fully elaborated in the provided documents. A...

CVE-2019-10657

Grandstream GWN7000 before 1.0.6.32 and GWN7610 before 1.0.8.18 devices allow remote authenticated users to discover passwords via a /ubus/uci.apply config request...

CVE-2019-10656

Grandstream GWN7000 before 1.0.6.32 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the filename in a /ubus/uci.apply updatendswebrootfromtmp API call...

CVE-2019-10656

Summary: CVE-2019-10656 affects Grandstream GWN7000 prior to 1.0.6.32. Affected component is the /ubus/uci.apply update_nds_webroot_from_tmp API call, where remote authenticated users can inject shell metacharacters in a filename to execute arbitrary code on the device. Public references across d...

CVE-2019-10655

Grandstream GAC2500 1.0.3.35, GXP2200 1.0.3.27, GVC3202 1.0.3.51, GXV3275 before 1.0.3.219 Beta, and GXV3240 before 1.0.3.219 Beta devices allow unauthenticated remote code execution via shell metacharacters in a /manager?action=getlogcat priority field, in conjunction with a buffer overflow via...