// For flags

CVE-2020-5738

 

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker uploads a specially crafted tar file to the HTTP /cgi-bin/upload_vpntar interface.

La serie Grandstream GXP1600 versión de firmware 1.0.4.152 y posteriores, es vulnerable a una ejecución de comandos remota autenticada cuando un atacante carga un archivo tar especialmente diseñado en la interfaz HTTP /cgi-bin/upload_vpntar.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-01-06 CVE Reserved
  • 2020-04-14 CVE Published
  • 2024-05-24 EPSS Updated
  • 2024-08-04 CVE Updated
  • 2024-08-04 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-59: Improper Link Resolution Before File Access ('Link Following')
CAPEC
References (1)
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Grandstream
Search vendor "Grandstream"
Gxp1610 Firmware
Search vendor "Grandstream" for product "Gxp1610 Firmware"
<= 1.0.4.152
Search vendor "Grandstream" for product "Gxp1610 Firmware" and version " <= 1.0.4.152"
-
Affected
in Grandstream
Search vendor "Grandstream"
Gxp1610
Search vendor "Grandstream" for product "Gxp1610"
--
Safe
Grandstream
Search vendor "Grandstream"
Gxp1615 Firmware
Search vendor "Grandstream" for product "Gxp1615 Firmware"
<= 1.0.4.152
Search vendor "Grandstream" for product "Gxp1615 Firmware" and version " <= 1.0.4.152"
-
Affected
in Grandstream
Search vendor "Grandstream"
Gxp1615
Search vendor "Grandstream" for product "Gxp1615"
--
Safe
Grandstream
Search vendor "Grandstream"
Gxp1620 Firmware
Search vendor "Grandstream" for product "Gxp1620 Firmware"
<= 1.0.4.152
Search vendor "Grandstream" for product "Gxp1620 Firmware" and version " <= 1.0.4.152"
-
Affected
in Grandstream
Search vendor "Grandstream"
Gxp1620
Search vendor "Grandstream" for product "Gxp1620"
--
Safe
Grandstream
Search vendor "Grandstream"
Gxp1625 Firmware
Search vendor "Grandstream" for product "Gxp1625 Firmware"
<= 1.0.4.152
Search vendor "Grandstream" for product "Gxp1625 Firmware" and version " <= 1.0.4.152"
-
Affected
in Grandstream
Search vendor "Grandstream"
Gxp1625
Search vendor "Grandstream" for product "Gxp1625"
--
Safe
Grandstream
Search vendor "Grandstream"
Gxp1628 Firmware
Search vendor "Grandstream" for product "Gxp1628 Firmware"
<= 1.0.4.152
Search vendor "Grandstream" for product "Gxp1628 Firmware" and version " <= 1.0.4.152"
-
Affected
in Grandstream
Search vendor "Grandstream"
Gxp1628
Search vendor "Grandstream" for product "Gxp1628"
--
Safe
Grandstream
Search vendor "Grandstream"
Gxp1630 Firmware
Search vendor "Grandstream" for product "Gxp1630 Firmware"
<= 1.0.4.152
Search vendor "Grandstream" for product "Gxp1630 Firmware" and version " <= 1.0.4.152"
-
Affected
in Grandstream
Search vendor "Grandstream"
Gxp1630
Search vendor "Grandstream" for product "Gxp1630"
--
Safe