Описание
An issue was discovered on the Grandstream HT801 Analog Telephone Adaptor before 1.0.29.8. From the limited configuration shell, it is possible to set the malicious gdb_debug_server variable. As a result, after a reboot, the device downloads and executes malicious scripts from an attacker-defined host.
Ссылки
- Broken Link
- ProductVendor Advisory
- ExploitThird Party Advisory
- Broken Link
- ProductVendor Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.0.29.8 (исключая)
Одновременно
cpe:2.3:o:grandstream:ht801_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:grandstream:ht801:-:*:*:*:*:*:*:*
EPSS
Процентиль: 74%
0.00794
Низкий
8.8 High
CVSS3
9 Critical
CVSS2
Дефекты
NVD-CWE-noinfo
Связанные уязвимости
github
больше 3 лет назад
An issue was discovered on the Grandstream HT801 Analog Telephone Adaptor before 1.0.29.8. From the limited configuration shell, it is possible to set the malicious gdb_debug_server variable. As a result, after a reboot, the device downloads and executes malicious scripts from an attacker-defined host.
EPSS
Процентиль: 74%
0.00794
Низкий
8.8 High
CVSS3
9 Critical
CVSS2
Дефекты
NVD-CWE-noinfo