Grandstream GXV3370 and Grandstream WP820 Command Injection Vulnerabilities

Grandstream GXV3370 and Grandstream WP820 are both products of Grandstream, an IP video phone device.Grandstream GXV3370 is a portable enterprise WiFi phone. A security vulnerability exists in the Grandstream GXV3370 version prior to 1.0.1.41 and the WP820 version prior to 1.0.3.6. An attacker ca...

Grandstream GXP16xx Shell Metacharacter Injection Vulnerability

The Grandstream GXP16xx VoIP is a 16XX series IP phone from Grandstream. A shell metacharacter injection vulnerability exists in the SSH configuration interface of the Grandstream GXP16xx 1.0.4.128, which can be exploited by an attacker to execute arbitrary system commands and obtain a root shell...

Grandstream GXV3611IR_HD Trust Management Issues Vulnerability

The Grandstream GXV3611IRHD is a webcam from Grandstream. A security vulnerability exists in Grandstream GXV3611IRHD versions prior to 1.0.3.23. An attacker can exploit the default password or hard-coded passwords, hard-coded certificates, etc. to attack the affected components...

Grandstream UCM6204 SQL Injection Vulnerability

The Grandstream UCM6204 is an IP PBX Private Branch eXchange device from Grandstream. A SQL injection vulnerability exists in the Grandstream UCM6204 prior to version 1.0.19.20, which arises from a database-based application that lacks validation of externally entered SQL statements. An attacker...

CVE-2018-17564

A Malformed Input String to /cgi-bin/deleteCA on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to delete configuration parameters and gain admin access to the device...

CVE-2018-17565

Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute arbitrary system commands and gain a root shell...

CVE-2018-17565

Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute arbitrary system commands and gain a root shell...

CVE-2018-17564

A Malformed Input String to /cgi-bin/deleteCA on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to delete configuration parameters and gain admin access to the device...

CVE-2018-17563

A Malformed Input String to /cgi-bin/api-getlinestatus on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to dump the device's configuration in cleartext...

CVE-2018-17563

A Malformed Input String to /cgi-bin/api-getlinestatus on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to dump the device's configuration in cleartext...

Input validation

A Malformed Input String to /cgi-bin/deleteCA on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to delete configuration parameters and gain admin access to the device...

Design/Logic Flaw

Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute arbitrary system commands and gain a root shell...

Input validation

A Malformed Input String to /cgi-bin/api-getlinestatus on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to dump the device's configuration in cleartext...

CVE-2018-17565

The CVE-2018-17565 entry concerns a Shell Metacharacter Injection vulnerability in the SSH configuration interface of Grandstream GXP16xx VoIP phones (firmware 1.0.4.128). The vulnerability allows an attacker to execute arbitrary system commands and obtain a root shell. Public documents identify ...

CVE-2018-17565

Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute arbitrary system commands and gain a root shell...

CVE-2018-17564

A Malformed Input String to /cgi-bin/deleteCA on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to delete configuration parameters and gain admin access to the device...

CVE-2018-17564

The CVE-2018-17564 issue affects Grandstream GXP16xx VoIP phones (e.g., 1.0.4.128). A malformed input string to /cgi-bin/delete_CA allows an attacker to delete configuration parameters and gain administrator access. Root cause: input validation flaw at the /cgi-bin/delete_CA endpoint. Impact: par...

CVE-2018-17563

The CVE-2018-17563 vulnerability affects Grandstream GXP16xx VoIP phones (example 1.0.4.128). A malformed input string to /cgi-bin/api-get_line_status allows an attacker to dump the device configuration in plaintext, constituting an information disclosure issue. The root cause is a malformed inpu...

CVE-2018-17563

A Malformed Input String to /cgi-bin/api-getlinestatus on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to dump the device's configuration in cleartext...

Multiple Command Injection Vulnerabilities in Grandstream Products

Multiple Vulnerabilities in Grandstream devices. - The affected devices are: GAC2500, GVC3202, GXP2200, GXV3275, GXV3240, GXV3611IRHD, GXV3611IRHD, GXV3611IRHD, UCM6204, GXV3370, WP820, GWN7000, & GWN7610. - A remote command execution vulnerability exists in the 'priority' and 'logserver'...