PT-2015-5949 · Grandstream · Grandstream Gxv3611Hd/Ll

Pizza1337 · Publicado 2015-07-08 · Atualizado 2017-09-03 · CVE-2015-2866

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Grandstream GXV3611 HD camera versions prior to 1.0.3.9 beta

Description The issue allows remote attackers to execute arbitrary SQL commands by attempting to establish a TELNET session with a crafted username. This can be done by sending a request to the TELNET endpoint with a specially crafted username variable.

Recommendations For Grandstream GXV3611 HD camera versions prior to 1.0.3.9 beta, update to version 1.0.3.9 beta or later to resolve the issue. As a temporary workaround, consider restricting TELNET access to minimize the risk of exploitation. Avoid using crafted usernames in TELNET sessions until the issue is resolved.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2015-2866

Produtos afetados

Grandstream Gxv3611Hd/Ll

Referências · 3

• 🔥 https://exploit-db.com/exploits/40441 · Exploit
• http://kb.cert.org/vuls/id/253708 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-2866 · Nota de Segurança