Vulnerabilities > Grandstream > High

DATE CVE VULNERABILITY TITLE RISK
2021-03-29 CVE-2020-25217 Command Injection vulnerability in Grandstream products
Grandstream GRP261x VoIP phone running firmware version 1.0.3.6 (Base) allows Command Injection as root in its administrative web interface.
network
low complexity
grandstream CWE-77
7.2
2020-07-29 CVE-2020-5761 Infinite Loop vulnerability in Grandstream products
Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to CPU exhaustion due to an infinite loop in the TR-069 service.
network
low complexity
grandstream CWE-835
7.8
2019-04-01 CVE-2018-17564 Unspecified vulnerability in Grandstream products
A Malformed Input String to /cgi-bin/delete_CA on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to delete configuration parameters and gain admin access to the device.
network
low complexity
grandstream
7.5
2019-03-30 CVE-2019-10662 OS Command Injection vulnerability in Grandstream Ucm6204 Firmware
Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the backupUCMConfig file-backup parameter to the /cgi? URI.
network
low complexity
grandstream CWE-78
8.8
2019-03-30 CVE-2019-10660 OS Command Injection vulnerability in Grandstream Gxv3611Ir HD Firmware
Grandstream GXV3611IR_HD before 1.0.3.23 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the /goform/systemlog?cmd=set logserver field.
network
low complexity
grandstream CWE-78
8.8
2019-03-30 CVE-2019-10659 OS Command Injection vulnerability in Grandstream Gxv3370 Firmware and Wp820 Firmware
Grandstream GXV3370 before 1.0.1.41 and WP820 before 1.0.3.6 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in a /manager?action=getlogcat priority field.
network
low complexity
grandstream CWE-78
8.8
2019-03-30 CVE-2019-10658 OS Command Injection vulnerability in Grandstream Gwn7610 Firmware
Grandstream GWN7610 before 1.0.8.18 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the filename in a /ubus/controller.icc.update_nds_webroot_from_tmp update_nds_webroot_from_tmp API call.
network
low complexity
grandstream CWE-78
8.8
2019-03-30 CVE-2019-10656 OS Command Injection vulnerability in Grandstream Gwn7000 Firmware
Grandstream GWN7000 before 1.0.6.32 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the filename in a /ubus/uci.apply update_nds_webroot_from_tmp API call.
network
low complexity
grandstream CWE-78
8.8
2019-03-30 CVE-2019-10655 OS Command Injection vulnerability in Grandstream products
Grandstream GAC2500 1.0.3.35, GXP2200 1.0.3.27, GVC3202 1.0.3.51, GXV3275 before 1.0.3.219 Beta, and GXV3240 before 1.0.3.219 Beta devices allow unauthenticated remote code execution via shell metacharacters in a /manager?action=getlogcat priority field, in conjunction with a buffer overflow (via the phonecookie cookie) to overwrite a data structure and consequently bypass authentication.
network
low complexity
grandstream CWE-78
7.5
2015-07-08 CVE-2015-2866 SQL Injection vulnerability in Grandstream Gxv3611 HD Firmware
SQL injection vulnerability on the Grandstream GXV3611_HD camera with firmware before 1.0.3.9 beta allows remote attackers to execute arbitrary SQL commands by attempting to establish a TELNET session with a crafted username.
network
low complexity
grandstream CWE-89
7.5