Grandstream GXV31XX 'settimezone' Unauthenticated Command Execution

This module exploits a command injection vulnerability in Grandstream GXV31XX IP multimedia phones. The 'settimezone' action does not validate input in the 'timezone' parameter allowing injection of arbitrary commands. A buffer overflow in the 'phonecookie' cookie parsing allows authentication to...

Grandstream Wave Update Redirection Vulnerability

Grandstream Wave is a suite of free VoIP applications. Grandstream Wave uses an insecure connection to download update information, which can be exploited by an attacker to perform a redirection attack and trick users into downloading a malicious update package...

Grandstream Wave Redirection Vulnerability

Grandstream Wave is a suite of free VoIP applications. Grandstream Wave uses an insecure connection to obtain a configuration file, which allows an attacker to impersonate a configuration server with invalid, mismatched, or expired certificates, redirect phone calls, or cause dialed calls to...

Grandstream Wave Redirection Vulnerability

Grandstream Wave is a free VoIP application from Grandstream. The application supports multiple accounts, simultaneous use of multiple lines, and more. A redirection vulnerability exists in Grandstream Wave version 1.0.1.26, which originates when the program uses an unsecured connection to downlo...

grandstream.cn XSS vulnerability

Vulnerable URL: http://www.grandstream.cn/Admin/Error.aspx?Tip= Details: Description| Value ---|--- Patched:| No Latest check for patch:| 26.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 5264915 Google Pagerank| 3 VIP website status:| No Check grandstream....

Grandstream Wave 1.0.1.26 Update Redirection

CVE-2016-1520: GrandStream Android VoIP App Update Redirection ============================================================== Affected app: Grandstream WaveGSWAVE version 1.0.1.26 and probably earlier Classification: CWE-300 Channel Accessible by Non-EndpointCWE300 CWE-319 Cleartext Transmission ...

Multiple Vulnerabilities in Grandstream GXV3275

The Grandstream GXV3275 is an IP multimedia phone running on Android. Grandstream GXV3275 has multiple security vulnerabilities that could be exploited by remote attackers to submit a special request to execute arbitrary commands, elevate privileges, etc...

CVE-2015-2866

SQL injection vulnerability on the Grandstream GXV3611HD camera with firmware before 1.0.3.9 beta allows remote attackers to execute arbitrary SQL commands by attempting to establish a TELNET session with a crafted username...

Sql injection

SQL injection vulnerability on the Grandstream GXV3611HD camera with firmware before 1.0.3.9 beta allows remote attackers to execute arbitrary SQL commands by attempting to establish a TELNET session with a crafted username...

CVE-2015-2866

CVE-2015-2866 affects Grandstream GXV3611_HD cameras (firmware before 1.0.3.9 beta). The issue is a SQL injection in the telnet login username, allowing remote attackers to execute arbitrary SQL commands. Public details come from NVD/Cert/CVE records and exploit references. Remediation per source...

CVE-2015-2866

SQL injection vulnerability on the Grandstream GXV3611HD camera with firmware before 1.0.3.9 beta allows remote attackers to execute arbitrary SQL commands by attempting to establish a TELNET session with a crafted username...

Grandstream GXV3275 SSH Key / Command Execution Vulnerability

Grandstream GXV3275 ships with a default root SSH key which could be used a backdoor. It also suffers from an issue where restricted commands can be leveraged to break out into a full shell. The Grandstream GXV3275 is an Android-based VoIP phone. Several vulnerabilities were found affecting this...

Grandstream GXV3275 < 1.0.3.30 - Multiple Vulnerabilities

The Grandstream GXV3275 is an Android-based VoIP phone. Several vulnerabilities were found affecting this device. The device ships with a default root SSH key, which could be used as a backdoor: /system/root/.ssh cat authorizedkeys Public key portion is: ssh-rsa...

Grandstream GXV3275 1.0.3.30 - Multiple Vulnerabilities

Grandstream GXV3275 1.0.3.30 - Multiple Vulnerabilities The Grandstream GXV3275 is an Android-based VoIP phone. Several vulnerabilities were found affecting this device. The device ships with a default root SSH key, which could be used as a backdoor: /system/root/.ssh cat authorizedkeys Public ke...

Grandstream GXV3275 SSH Key / Command Execution

The Grandstream GXV3275 is an Android-based VoIP phone. Several vulnerabilities were found affecting this device. The device ships with a default root SSH key, which could be used as a backdoor: /system/root/.ssh cat authorizedkeys Public key portion is: ssh-rsa...

Grandsteam GXV3611_HD camera is vulnerable to SQL injection

Overview The Grandsteam GXV3611HD is an IP network camera used for surveillance and security. The Grandsteam GXV3611HD is vulnerable to a SQL injection attack. Description CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' - CVE-2015-2866The Grandstream...

Grandstream GXV-3000 Phone Remote Denial of Service Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/25399/info Grandstream GXV-3000 phones are prone to a remote denial-of-service vulnerability. Exploiting this issue allows remote attackers to cause the device to accept a phone while being unable to hang up. This...

Grandstream GXP VOIP Phones Default Credentials (HTTP)

The remote Grandstream GXP VOIP Phone is using known default credentials. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2013-3962

Cross-site scripting XSS vulnerability in Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WPHD, GXV3500, and possibly other camera models before firmware 1.0.4.44, allows remote attackers to inject arbitrary web script or HTML via the...

CVE-2013-3963

Cross-site request forgery CSRF vulnerability in goform/usermanage in Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WPHD, GXV3500, and possibly other camera models allows remote attackers to hijack the authentication of unspecified...