Evil-DB LogoEvil-DB
← All CVEs

CVE-2019-10655

critical · 9.8

Grandstream GAC2500 1.0.3.35, GXP2200 1.0.3.27, GVC3202 1.0.3.51, GXV3275 before 1.0.3.219 Beta, and GXV3240 before 1.0.3.219 Beta devices allow unauthenticated remote code execution via shell metacharacters in a /manager?action=getlogcat priority field, in conjunction with a buffer overflow (via the phonecookie cookie) to overwrite a data structure and consequently bypass authentication. This can be exploited remotely or via CSRF because the cookie can be placed in an Accept HTTP header in an XMLHttpRequest call to lighttpd.

9.8
CVSS
15.5%
EPSS (exploit prob.)
97th
EPSS percentile
2019-03-30
Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-78CWE-119CWE-352

Affected products

VendorProductAffected versions
grandstreamgac2500_firmware<= 1.0.3.35
grandstreamgac2500all versions
grandstreamgvc3202_firmware< 1.0.3.51
grandstreamgvc3202all versions
grandstreamgxv3275_firmware< 1.0.3.219
grandstreamgxv3275all versions
grandstreamgxv3240_firmware< 1.0.3.219
grandstreamgxv3240all versions
grandstreamgxp2200_firmware<= 1.0.3.27
grandstreamgxp2200all versions

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2019-10655