Sfewer-R7

Name of the Vulnerable Software and Affected Versions: Grandstream GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630 versions prior to 1.0.7.81. Description: A critical unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. This vulnerability allows a remote attacker to achieve unauthenticated remote code execution (RCE) with root privileges on a target device. Exploitation can lead to credential theft, call interception, and the ability to reconfigure the device for malicious purposes, such as redirecting calls through a rogue SIP proxy. The vulnerability affects Grandstream GXP1600 series VoIP phones. Recommendations: Update the firmware to version 1.0.7.81 or later.

**Name of the Vulnerable Software and Affected Versions** ConnectWise ScreenConnect versions 23.9.7 and prior **Description** The vulnerability is an authentication bypass using an alternate path or channel, which may allow an attacker direct access to confidential information or critical systems. This issue has been exploited in real-world attacks, with threat actors using it to deploy ransomware and steal information. The estimated number of potentially affected devices worldwide is not specified, but it is known that hundreds of initial access brokers and cybercrime gangs are exploiting this vulnerability, threatening organizations and downstream customers. Technical details about exploitation include the use of an alternate path or channel to bypass authentication, potentially allowing attackers to create admin accounts, delete other users, and take over vulnerable instances. **Recommendations** To resolve the issue for ConnectWise ScreenConnect versions 23.9.7 and prior, update to the patched version immediately. As a temporary workaround, consider restricting access to the vulnerable software until a patch is applied. Additionally, enabling multi-factor authentication (MFA) can help minimize the risk of exploitation. It is also recommended to apply mitigations to protect organizations from cyberattacks, such as those suggested by CISA.