Multiple Command Injection Vulnerabilities in Grandstream Products
Critical Nessus Plugin ID 123520
Synopsis
The remote device is vulnerable and can be compromised
Description
Multiple Vulnerabilities in Grandstream devices.
- The affected devices are: GAC2500, GVC3202, GXP2200, GXV3275, GXV3240, GXV3611IR_HD, GXV3611IR_HD, GXV3611IR_HD, UCM6204, GXV3370, WP820, GWN7000, & GWN7610.
- A remote command execution vulnerability exists in the 'priority' and 'logserver' parameters. An unauthenticated, remote attacker can exploit them to bypass authentication and execute arbitrary commands with root privileges.
- A blind command injection vulnerability exists in the 'filename' and 'file-backup' parameters. An unauthenticated, remote attacker can exploit this to bypass authentication and obtain a root shell.
Solution
Update to the fixed version as per the advisory.