9

CVE-2020-5739

Exploit
Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker adds an OpenVPN up script to the phone's VPN settings via the "Additional Settings" field in the web interface. When the VPN's connection is established, the user defined script is executed with root privileges.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Grandstream ≫ Gxp1610 Firmware Version <= 1.0.4.152
   Grandstream ≫ Gxp1610 Version-
Grandstream ≫ Gxp1615 Firmware Version <= 1.0.4.152
   Grandstream ≫ Gxp1615 Version-
Grandstream ≫ Gxp1620 Firmware Version <= 1.0.4.152
   Grandstream ≫ Gxp1620 Version-
Grandstream ≫ Gxp1625 Firmware Version <= 1.0.4.152
   Grandstream ≫ Gxp1625 Version-
Grandstream ≫ Gxp1628 Firmware Version <= 1.0.4.152
   Grandstream ≫ Gxp1628 Version-
Grandstream ≫ Gxp1630 Firmware Version <= 1.0.4.152
   Grandstream ≫ Gxp1630 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.44% 0.847
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 9 8 10
AV:N/AC:L/Au:S/C:C/I:C/A:C
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.