586 matches found
Session fixation
The auto-provisioning mechanism in the Grandstream Wave app 1.0.1.26 and earlier for Android and Grandstream Video IP phones allows man-in-the-middle attackers to spoof provisioning data and consequently modify device functionality, obtain sensitive information from system logs, and have...
Design/Logic Flaw
The Grandstream Wave app 1.0.1.26 and earlier for Android does not use HTTPS when retrieving update information, which might allow man-in-the-middle attackers to execute arbitrary code via a crafted application...
CVE-2016-1518
The auto-provisioning mechanism in the Grandstream Wave app 1.0.1.26 and earlier for Android and Grandstream Video IP phones allows man-in-the-middle attackers to spoof provisioning data and consequently modify device functionality, obtain sensitive information from system logs, and have...
Code injection
The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validate SSL certificates, which allows man-in-the-middle attackers to spoof the Grandstream provisioning server via a crafted certificate...
CVE-2016-1519
The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validate SSL certificates, which allows man-in-the-middle attackers to spoof the Grandstream provisioning server via a crafted certificate...
CVE-2016-1520
The Grandstream Wave app 1.0.1.26 and earlier for Android does not use HTTPS when retrieving update information, which might allow man-in-the-middle attackers to execute arbitrary code via a crafted application...
CVE-2016-1520
The Grandstream Wave app 1.0.1.26 and earlier for Android does not use HTTPS when retrieving update information, which might allow man-in-the-middle attackers to execute arbitrary code via a crafted application...
CVE-2016-1519
The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validate SSL certificates, which allows man-in-the-middle attackers to spoof the Grandstream provisioning server via a crafted certificate...
CVE-2016-1518
The auto-provisioning mechanism in the Grandstream Wave app 1.0.1.26 and earlier for Android and Grandstream Video IP phones allows man-in-the-middle attackers to spoof provisioning data and consequently modify device functionality, obtain sensitive information from system logs, and have...
CVE-2016-1518
CVE-2016-1518 affects the Grandstream Wave app (Android, versions up to 1.0.1.26 and earlier) and Grandstream Video IP phones. The root cause is failure to use HTTPS when downloading provisioning/configuration data from http://fm.grandstream.com/gs/, enabling a man-in-the-middle to spoof provisio...
CVE-2016-1519
Affected software: Grandstream Wave app for Android (package com.softphone.common), versions up to and including 1.0.1.26. Vulnerability: Improper SSL certificate validation in the app’s provisioning flow. Impact: Enables MITM attackers to spoof the Grandstream provisioning server via a crafted c...
CVE-2016-1520
The CVE-2016-1520 issue affects the Grandstream Wave Android app (1.0.1.26 and earlier). The root cause is that update information is retrieved over HTTP instead of HTTPS, enabling a man-in-the-middle to craft updates and potentially execute arbitrary code on the device. Public details indicate t...
CVE-2016-1520: Undefined Security Weakness
The Grandstream Wave app 1.0.1.26 and earlier for Android does not use HTTPS when retrieving update information, which might allow man-in-the-middle attackers to execute arbitrary code via a crafted application...
CVE-2016-1518: Improper Access Control
The auto-provisioning mechanism in the Grandstream Wave app 1.0.1.26 and earlier for Android and Grandstream Video IP phones allows man-in-the-middle attackers to spoof provisioning data and consequently modify device functionality, obtain sensitive information from system logs, and have...
CVE-2016-1519: Improper Certificate Validation
The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validate SSL certificates, which allows man-in-the-middle attackers to spoof the Grandstream provisioning server via a crafted certificate...
Grandstream HT701 IP analog telephone adapter background of the weak password vulnerability
No description provided by source. !/usr/bin/env python coding: utf-8 from pocsuite.api.request import req from pocsuite.api.poc import register from pocsuite.api.poc import Output, POCBase import re class TestPOCPOCBase: vulID = '' ssvid version = '1.0' author = 'Hcamael' vulDate = '2016-11-11'...
Grandstream UCM Series IP PBX Detection (SIP)
SIP based detection of Grandstream UCM devices. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Grandsteam GXV3611_HD - SQL Injection
Grandsteam GXV3611HD - SQL Injection Exploit Title: Grandstream GXV3611HD Telnet SQL Injection and backdoor command Exploit Author: pizza1337 Vendor Homepage: http://www.grandstream.com/ Version: GXV3611HD Core 1.0.3.6, 1.0.4.3 GXV3611IRHD Core 1.0.3.5 Tested on: -GXV3611HD Bootloader Version:...
Grandsteam GXV3611_HD - SQL Injection
Exploit Title: Grandstream GXV3611HD Telnet SQL Injection and backdoor command Exploit Author: pizza1337 Vendor Homepage: http://www.grandstream.com/ Version: GXV3611HD Core 1.0.3.6, 1.0.4.3 GXV3611IRHD Core 1.0.3.5 Tested on: -GXV3611HD Bootloader Version: 1.0.0.0 Core Version: 1.0.4.3 Base...
Grandstream GXV31XX 'settimezone' Unauthenticated Command Execution
This module exploits a command injection vulnerability in Grandstream GXV31XX IP multimedia phones. The 'settimezone' action does not validate input in the 'timezone' parameter allowing injection of arbitrary commands. A buffer overflow in the 'phonecookie' cookie parsing allows authentication to...