Scarvell

**Name of the Vulnerable Software and Affected Versions** Grandstream GAC2500 version 1.0.3.35 Grandstream GXP2200 version 1.0.3.27 Grandstream GVC3202 version 1.0.3.51 Grandstream GXV3275 versions prior to 1.0.3.219 Beta Grandstream GXV3240 versions prior to 1.0.3.219 Beta **Description** The issue allows unauthenticated remote code execution via shell metacharacters in a "/manager?action=getlogcat" priority field. This is done in conjunction with a buffer overflow, via the `phonecookie` cookie, to overwrite a data structure and consequently bypass authentication. The exploitation can occur remotely or via CSRF, as the cookie can be placed in an Accept HTTP header in an XMLHttpRequest call to lighttpd. **Recommendations** For Grandstream GAC2500 version 1.0.3.35, update to a version that fixes the issue. For Grandstream GXP2200 version 1.0.3.27, update to a version that fixes the issue. For Grandstream GVC3202 version 1.0.3.51, update to a version that fixes the issue. For Grandstream GXV3275 versions prior to 1.0.3.219 Beta, update to version 1.0.3.219 Beta or later. For Grandstream GXV3240 versions prior to 1.0.3.219 Beta, update to version 1.0.3.219 Beta or later. As a temporary workaround, consider restricting access to the "/manager?action=getlogcat" endpoint until a patch is available. Avoid using the `phonecookie` cookie in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Grandstream GXV3611IR HD version 1.0.3.23 and earlier **Description** The issue allows remote authenticated users to execute arbitrary code via shell metacharacters in the "/goform/systemlog?cmd=set logserver" field. This is a remote code execution issue that can be exploited by authenticated users. **Recommendations** For Grandstream GXV3611IR HD version 1.0.3.23 and earlier, update to version 1.0.3.23 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/goform/systemlog" API endpoint to minimize the risk of exploitation. Avoid using the `logserver` field in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Cacti versions prior to 1.1.18 **Description** The issue allows for XSS via the title field of an external link added by an authenticated user in the lib/html.php file. **Recommendations** For versions prior to 1.1.18, update to version 1.1.18 or later to resolve the issue.