PT-2022-14472 · Grandstream · Grandstream Gsd3710

Published 2022-09-23 · Updated 2022-09-27 · CVE-2022-2025

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Grandstream GSD3710 version 1.0.11.13

Description The issue allows an attacker with knowledge of user and password to overflow the stack, as it does not check the parameter length before using the strcopy instruction. This could lead to an attacker executing a shell with full access.

Recommendations For Grandstream GSD3710 version 1.0.11.13, consider restricting access to the device until a patch is available, and ensure that all user credentials are securely managed to minimize the risk of exploitation. As a temporary workaround, consider disabling any functionality that uses the strcopy instruction until a patch is available.

Exploit

Fix

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

CVE-2022-2025

Affected Products

Grandstream Gsd3710

References · 6

• 🔥 https://exploit-db.com/exploits/52313 · Exploit
• https://osv.dev/vulnerability/CVE-2022-2025 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2025 · Security Note
• https://t.me/cvenotify/36844 · Telegram Post
• https://t.me/cibsecurity/50355 · Telegram Post
• https://incibe-cert.es/en/early-warning/security-advisories/buffer-overflow-vulnerabilities-grandstream-gsd3710 · Note