Vulnerabilities > CVE-2016-1520 - 7PK - Security Features vulnerability in Grandstream Wave 1.0.1.26
Attack vector
LOCAL Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
The Grandstream Wave app 1.0.1.26 and earlier for Android does not use HTTPS when retrieving update information, which might allow man-in-the-middle attackers to execute arbitrary code via a crafted application.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 1 |
Common Weakness Enumeration (CWE)
Packetstorm
| data source | https://packetstormsecurity.com/files/download/136291/grandstream-redir.txt |
| id | PACKETSTORM:136291 |
| last seen | 2016-12-05 |
| published | 2016-03-18 |
| reporter | Georg Lukas |
| source | https://packetstormsecurity.com/files/136291/Grandstream-Wave-1.0.1.26-Update-Redirection.html |
| title | Grandstream Wave 1.0.1.26 Update Redirection |
References
- http://packetstormsecurity.com/files/136291/Grandstream-Wave-1.0.1.26-Update-Redirection.html
- http://packetstormsecurity.com/files/136291/Grandstream-Wave-1.0.1.26-Update-Redirection.html
- http://www.securityfocus.com/archive/1/537821/100/0/threaded
- http://www.securityfocus.com/archive/1/537821/100/0/threaded
- https://rt-solutions.de/wp-content/uploads/2016/04/CVE-2016-1520-app-update-redirection.pdf
- https://rt-solutions.de/wp-content/uploads/2016/04/CVE-2016-1520-app-update-redirection.pdf