Multiple Command Injection Vulnerabilities in Grandstream Products
Critical Nessus Plugin ID 123520
SynopsisThe remote device is vulnerable and can be compromised
DescriptionMultiple Vulnerabilities in Grandstream devices.
- The affected devices are: GAC2500, GVC3202, GXP2200, GXV3275, GXV3240, GXV3611IR_HD, GXV3611IR_HD, GXV3611IR_HD, UCM6204, GXV3370, WP820, GWN7000, & GWN7610.
- A remote command execution vulnerability exists in the 'priority' and 'logserver' parameters. An unauthenticated, remote attacker can exploit them to bypass authentication and execute arbitrary commands with root privileges.
- A blind command injection vulnerability exists in the 'filename' and 'file-backup' parameters. An unauthenticated, remote attacker can exploit this to bypass authentication and obtain a root shell.
SolutionUpdate to the fixed version as per the advisory.