PT-2017-7962 · Grandstream · Grandstream Wave

Publicado 2017-04-21 · Atualizado 2018-10-09 · CVE-2016-1519

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Grandstream Wave app version 1.0.1.26 and earlier

Description The issue concerns the com.softphone.common package in the Grandstream Wave app, which fails to properly validate SSL certificates. This allows man-in-the-middle attackers to spoof the Grandstream provisioning server by using a crafted certificate.

Recommendations For Grandstream Wave app version 1.0.1.26 and earlier, consider disabling SSL certificate validation as a temporary workaround until a patch is available, but note that this could introduce additional security risks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2016-1519

Produtos afetados

Grandstream Wave

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-1519 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-1519 · Aviso do Fabricante
• http://securityfocus.com/archive/1/537819/100/0/threaded · Nota
• http://packetstormsecurity.com/files/136290/Grandstream-Wave-1.0.1.26-TLS-Man-In-The-Middle.html · Nota
• https://rt-solutions.de/wp-content/uploads/2016/04/CVE-2016-1519-gswave-tls-mitm.pdf · Nota