Grandstream GAC2500 1.0.3.35, GXP2200 1.0.3.27, GVC3202 1.0.3.51, GXV3275 before 1.0.3.219 Beta, and GXV3240 before 1.0.3.219 Beta devices allow unauthenticated remote code execution via shell metacharacters in a /manager?action=getlogcat priority field, in conjunction with a buffer overflow (via the phonecookie cookie) to overwrite a data structure and consequently bypass authentication. This can be exploited remotely or via CSRF because the cookie can be placed in an Accept HTTP header in an XMLHttpRequest call to lighttpd.

Multiple Vulnerabilities in Grandstream devices.

   - The affected devices are: GAC2500, GVC3202, GXP2200,      GXV3275, GXV3240, GXV3611IR_HD, GXV3611IR_HD, GXV3611IR_HD,      UCM6204, GXV3370, & WP820.

   - A remote command execution vulnerability exists in the 'priority'      and 'logserver' parameters. An unauthenticated, remote attacker can exploit      them to bypass authentication and execute arbitrary commands      with root privileges. 

   - A blind command injection vulnerability exists in the      'file-backup' parameter. An unauthenticated, remote attacker can      exploit this to bypass authentication and obtain a root shell.

The remote host is running a Grandstream GXV3275 device, firmware version prior to 1.0.3.219, and is therefore affected by a remote command execution vulnerability that exists in the 'priority' and 'logserver' parameters. An unauthenticated, remote attacker can exploit them to bypass authentication and execute arbitrary commands with root privileges.

The remote host is running a Grandstream GXV3240 device, firmware version prior to 1.0.3.219, and is therefore affected by a remote command execution vulnerability that exists in the 'priority' and 'logserver' parameters. An unauthenticated, remote attacker can exploit them to bypass authentication and execute arbitrary commands with root privileges.

Multiple Vulnerabilities in Grandstream devices.

   - The affected devices are: GAC2500, GVC3202, GXP2200,      GXV3275, GXV3240, GXV3611IR_HD, GXV3611IR_HD, GXV3611IR_HD,      UCM6204, GXV3370, WP820, GWN7000, & GWN7610.

   - A remote command execution vulnerability exists in the 'priority'      and 'logserver' parameters. An unauthenticated, remote attacker can exploit      them to bypass authentication and execute arbitrary commands      with root privileges.

   - A blind command injection vulnerability exists in the 'filename'      and 'file-backup' parameters. An unauthenticated, remote      attacker can exploit this to bypass authentication and obtain a root shell.

ID	Name	Product	Family	Severity
124173	Multiple Command Injection Vulnerabilities in Grandstream Products	Nessus	Misc.	critical
700497	Grandstream GXV3275 < 1.0.3.219 RCE	Nessus Network Monitor	IoT	critical
700496	Grandstream GXV3240 < 1.0.3.219 RCE	Nessus Network Monitor	IoT	critical
123520	Multiple Command Injection Vulnerabilities in Grandstream Products	Nessus	Misc.	critical

Detections

Analytics

CVE-2019-10655

critical

Tenable Plugins

critical

critical

critical

critical