PT-2019-11970 · Grandstream · Grandstream Gwn7610+1

Published 2019-03-30 · Updated 2023-03-01 · CVE-2019-10657

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Grandstream GWN7000 versions prior to 1.0.6.32 Grandstream GWN7610 versions prior to 1.0.8.18

Description The issue allows remote authenticated users to discover passwords via a "/ubus/uci.apply" config request. This could potentially lead to unauthorized access to sensitive information.

Recommendations For Grandstream GWN7000 versions prior to 1.0.6.32, update to version 1.0.6.32 or later. For Grandstream GWN7610 versions prior to 1.0.8.18, update to version 1.0.8.18 or later.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-10657

Affected Products

Grandstream Gwn7000

Grandstream Gwn7610

References · 4

• 🔥 https://github.com/scarvell/grandstream_exploits · Exploit
• https://osv.dev/vulnerability/CVE-2019-10657 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10657 · Security Note
• https://trustwave.com/en-us/resources/security-resources/security-advisories/?fid=23920&dl=1 · Note