PT-2019-11972 · Grandstream · Grandstream Gxv3370+1

Published 2019-03-30 · Updated 2023-03-01 · CVE-2019-10659

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Grandstream GXV3370 versions prior to 1.0.1.41 Grandstream WP820 versions prior to 1.0.3.6

Description The issue allows remote authenticated users to execute arbitrary code via shell metacharacters in a "priority field" of the /manager?action=getlogcat "API Endpoint".

Recommendations For Grandstream GXV3370 versions prior to 1.0.1.41, update to version 1.0.1.41 or later. For Grandstream WP820 versions prior to 1.0.3.6, update to version 1.0.3.6 or later.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-10659

Affected Products

Grandstream Gxv3370

Grandstream Wp820

References · 4

• 🔥 https://github.com/scarvell/grandstream_exploits · Exploit
• https://osv.dev/vulnerability/CVE-2019-10659 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10659 · Security Note
• https://trustwave.com/en-us/resources/security-resources/security-advisories/?fid=23920&dl=1 · Note