CVE-2024-32937

high · 8.1

An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of Grandstream GXP2135 1.0.9.129, 1.0.11.74 and 1.0.11.79. A specially crafted network packet can lead to arbitrary command execution. An attacker can send a sequence of malicious packets to trigger this vulnerability.

8.1

CVSS

26.3%

EPSS (exploit prob.)

98th

EPSS percentile

2024-07-03

Published

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-78

Affected products

Vendor	Product	Affected versions
grandstream	gxp2135_firmware	1.0.9.129
grandstream	gxp2135_firmware	1.0.11.74
grandstream	gxp2135_firmware	1.0.11.79
grandstream	gxp2135	all versions

Check a specific version with /api/v1/cve/match.

References

https://talosintelligence.com/vulnerability_reports/TALOS-2024-1978
https://talosintelligence.com/vulnerability_reports/TALOS-2024-1978
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1978

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-32937