Grandstream

Records57All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical14CVSS 9.0–10.0

CVSS high32CVSS 7.0–8.9

Exploited now

Grandstream records in CISA KEV

TI-2020-04650 Grandstream Networks UCM6200 Series SQL Injection Vulnerability CRITICAL 100KEV 2022-01-28

Components

Products in the NVD configurations · select one to filter the records

Ucm6204 Firmware 9 records HIGH Gxp1628 Firmware 7 records HIGH Ht802 Firmware 7 records MEDIUM Ucm6202 Firmware 7 records MEDIUM Ucm6208 Firmware 7 records MEDIUM Gxp1610 Firmware 6 records HIGH Gxp1615 Firmware 6 records HIGH Gxp1620 Firmware 6 records HIGH

Records

7 records in Ht802 Firmware · all components

TI-2020-04691 CVE-2020-5763 · GHSA-h2gv-99w3-wrfr

Grandstream HT800 series firmware version 1.0.17.5 and below contain a backdoor in the…

MEDIUM 43

Grandstream HT800 series firmware version 1.0.17.5 and below contain a backdoor in the SSH service.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02726 Published 2020-07-29 No fix listed CWE-489

TI-2020-04688 CVE-2020-5760 · GHSA-cfmm-v9fq-4h4j

OS command injection in Grandstream HT800 Series

MEDIUM 42

Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to an OS command injection vulnerability.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.0547 Published 2020-07-29 No fix listed CWE-78

TI-2020-04689 CVE-2020-5761 · GHSA-9wp9-6795-j8rm

Infinite loop in Grandstream HT800 Series

MEDIUM 40

Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to CPU exhaustion due to an infinite loop in the TR-069 service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04093 Published 2020-07-29 No fix listed CWE-835

TI-2020-04690 CVE-2020-5762 · GHSA-gqxx-7rgw-867q

NULL pointer dereference in Grandstream HT800 Series

LOW 39

Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to a denial of service attack against the TR-069 service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03361 Published 2020-07-29 No fix listed CWE-476

TI-2017-12176 CVE-2017-16565 · GHSA-7hqv-474g-2gh4

Cross-Site Request Forgery (CSRF) in /cgi-bin/login on Vonage (Grandstream) HT802 devices…

LOW 39

Cross-Site Request Forgery (CSRF) in /cgi-bin/login on Vonage (Grandstream) HT802 devices allows attackers to authenticate a user via the login screen using the default password of 123 and submit arbitrary requests.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00494 Published 2017-11-06 No fix listed CWE-352

TI-2017-12174 CVE-2017-16563 · GHSA-4pf2-94cv-wj99

Cross-Site Request Forgery (CSRF) in the Basic Settings screen on Vonage (Grandstream)…

LOW 35

Cross-Site Request Forgery (CSRF) in the Basic Settings screen on Vonage (Grandstream) HT802 devices allows attackers to modify settings, related to cgi-bin/update.

CVSS 3.0HIGH 8.0 Network Low privileges User interaction EPSS 0.00437 Published 2017-11-06 No fix listed CWE-352

TI-2017-12175 CVE-2017-16564 · GHSA-mc72-cfpm-m746

Stored Cross-site scripting (XSS) vulnerability in /cgi-bin/config2 on Vonage…

LOW 25

Stored Cross-site scripting (XSS) vulnerability in /cgi-bin/config2 on Vonage (Grandstream) HT802 devices allows remote authenticated users to inject arbitrary web script or HTML via the DHCP vendor class ID field (P148)…

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00614 Published 2017-11-06 No fix listed CWE-79

Open these records in search →