PT-2017-7962 · Grandstream · Grandstream Wave

Published 2017-04-21 · Updated 2018-10-09 · CVE-2016-1519

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Grandstream Wave app version 1.0.1.26 and earlier

Description The issue concerns the com.softphone.common package in the Grandstream Wave app, which fails to properly validate SSL certificates. This allows man-in-the-middle attackers to spoof the Grandstream provisioning server by using a crafted certificate.

Recommendations For Grandstream Wave app version 1.0.1.26 and earlier, consider disabling SSL certificate validation as a temporary workaround until a patch is available, but note that this could introduce additional security risks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2016-1519

Affected Products

Grandstream Wave

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-1519 · Security Note
• https://osv.dev/vulnerability/CVE-2016-1519 · Vendor Advisory
• http://securityfocus.com/archive/1/537819/100/0/threaded · Note
• http://packetstormsecurity.com/files/136290/Grandstream-Wave-1.0.1.26-TLS-Man-In-The-Middle.html · Note
• https://rt-solutions.de/wp-content/uploads/2016/04/CVE-2016-1519-gswave-tls-mitm.pdf · Note