PT-2019-6917 · Grandstream · Grandstream Gxv3601+8

Jonas Rc · Published 2019-12-11 · Updated 2019-12-19 · CVE-2013-3542

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP HD, GXV3500 versions 1.0.4.11

Description The issue allows remote attackers to obtain access via a TELNET session due to a hardcoded account !#/ with the same password.

Recommendations For Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP HD, GXV3500 version 1.0.4.11, consider changing the hardcoded password for the !#/ account as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2013-3542

Affected Products

Grandstream Gxv3500

Grandstream Gxv3501

Grandstream Gxv3504

Grandstream Gxv3601

Grandstream Gxv3601Hd/Ll

Grandstream Gxv3611Hd/Ll

Grandstream Gxv3615W/P

Grandstream Gxv3651Fhd

Grandstream Gxv3662Hd

References · 3

• 🔥 https://youtube.com/watch?v=XkCBs4lenhI · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-3542 · Security Note
• http://seclists.org/fulldisclosure/2013/Jun/84 · Note