PT-2019-11971 · Grandstream · Grandstream Gwn7610

Published 2019-03-30 · Updated 2023-03-01 · CVE-2019-10658

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Grandstream GWN7610 versions prior to 1.0.8.18

Description The issue allows remote authenticated users to execute arbitrary code via shell metacharacters in the filename in a "/ubus/controller.icc.update nds webroot from tmp" API call, specifically through the update nds webroot from tmp function.

Recommendations For Grandstream GWN7610 versions prior to 1.0.8.18, update to version 1.0.8.18 or later to resolve the issue. As a temporary workaround, consider restricting access to the /ubus/controller.icc.update nds webroot from tmp API endpoint until a patch is applied.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-10658

Affected Products

Grandstream Gwn7610

References · 4

• 🔥 https://github.com/scarvell/grandstream_exploits · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-10658 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10658 · Vendor Advisory
• https://trustwave.com/en-us/resources/security-resources/security-advisories/?fid=23920&dl=1 · Note