CVE-2020-5762

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to a denial of service attack against the TR-069 service. An unauthenticated remote attacker can stop the service due to a NULL pointer dereference in the TR-069 service. This condition is triggered due to mishandling of the HTTP Authentication field.

Grandstream serie HT800 versiones de firmware 1.0.17.5 y posteriores, es vulnerable a un ataque de denegación de servicio contra el servicio TR-069. Un atacante remoto no autenticado puede detener el servicio debido a una desreferencia del puntero NULL en el servicio TR-069. Esta condición es desencadenada debido a un manejo inapropiado del campo Authentication HTTP

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-01-06 CVE Reserved
2020-07-29 CVE Published
2023-07-18 EPSS Updated
2024-08-04 CVE Updated
2024-08-04 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-476: NULL Pointer Dereference

CAPEC

References (2)

URL	Tag	Source
https://www.tenable.com/security/research/tra-2020-47	Third Party Advisory

URL	Date	SRC
https://www.tenable.com/security/research/tra-2020-43	2024-08-04

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Grandstream Search vendor "Grandstream"	Ht801 Firmware Search vendor "Grandstream" for product "Ht801 Firmware"	<= 1.0.17.5 Search vendor "Grandstream" for product "Ht801 Firmware" and version " <= 1.0.17.5"	-	Affected	in	Grandstream Search vendor "Grandstream"	Ht801 Search vendor "Grandstream" for product "Ht801"	-	-	Safe
Grandstream Search vendor "Grandstream"	Ht802 Firmware Search vendor "Grandstream" for product "Ht802 Firmware"	<= 1.0.17.5 Search vendor "Grandstream" for product "Ht802 Firmware" and version " <= 1.0.17.5"	-	Affected	in	Grandstream Search vendor "Grandstream"	Ht802 Search vendor "Grandstream" for product "Ht802"	-	-	Safe
Grandstream Search vendor "Grandstream"	Ht812 Firmware Search vendor "Grandstream" for product "Ht812 Firmware"	<= 1.0.17.5 Search vendor "Grandstream" for product "Ht812 Firmware" and version " <= 1.0.17.5"	-	Affected	in	Grandstream Search vendor "Grandstream"	Ht812 Search vendor "Grandstream" for product "Ht812"	-	-	Safe
Grandstream Search vendor "Grandstream"	Ht814 Firmware Search vendor "Grandstream" for product "Ht814 Firmware"	<= 1.0.17.5 Search vendor "Grandstream" for product "Ht814 Firmware" and version " <= 1.0.17.5"	-	Affected	in	Grandstream Search vendor "Grandstream"	Ht814 Search vendor "Grandstream" for product "Ht814"	-	-	Safe
Grandstream Search vendor "Grandstream"	Ht818 Firmware Search vendor "Grandstream" for product "Ht818 Firmware"	<= 1.0.17.5 Search vendor "Grandstream" for product "Ht818 Firmware" and version " <= 1.0.17.5"	-	Affected	in	Grandstream Search vendor "Grandstream"	Ht818 Search vendor "Grandstream" for product "Ht818"	-	-	Safe
Grandstream Search vendor "Grandstream"	Ht813 Firmware Search vendor "Grandstream" for product "Ht813 Firmware"	<= 1.0.17.5 Search vendor "Grandstream" for product "Ht813 Firmware" and version " <= 1.0.17.5"	-	Affected	in	Grandstream Search vendor "Grandstream"	Ht813 Search vendor "Grandstream" for product "Ht813"	-	-	Safe