PT-2017-7963 · Grandstream · Grandstream Wave

Published 2017-04-21 · Updated 2018-10-09 · CVE-2016-1520

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Grandstream Wave app versions 1.0.1.26 and earlier

Description The issue concerns the Grandstream Wave app not using HTTPS when retrieving update information. This might allow man-in-the-middle attackers to execute arbitrary code via a crafted application.

Recommendations For Grandstream Wave app versions 1.0.1.26 and earlier, consider updating to a newer version that uses HTTPS for retrieving update information to prevent man-in-the-middle attacks.

Fix

Weakness Enumeration

CWE-254

Related Identifiers

CVE-2016-1520

Affected Products

Grandstream Wave

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-1520 · Security Note
• https://osv.dev/vulnerability/CVE-2016-1520 · Vendor Advisory
• http://securityfocus.com/archive/1/537821/100/0/threaded · Note
• https://rt-solutions.de/wp-content/uploads/2016/04/CVE-2016-1520-app-update-redirection.pdf · Note
• http://packetstormsecurity.com/files/136291/Grandstream-Wave-1.0.1.26-Update-Redirection.html · Note