PT-2017-7963

CVE-2016-1520

·

Published

2017-04-21

·

Updated

2018-10-09

Description by

CVSS 3.1
7.8
High
MetricsAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Grandstream Wave app versions 1.0.1.26 and earlier
Description The issue concerns the Grandstream Wave app not using HTTPS when retrieving update information. This might allow man-in-the-middle attackers to execute arbitrary code via a crafted application.
Recommendations For Grandstream Wave app versions 1.0.1.26 and earlier, consider updating to a newer version that uses HTTPS for retrieving update information to prevent man-in-the-middle attacks.
Exploitability
Fix
Vendors
Affected products
Weakness enumeration
CWE-254
Related identifiers
CVE-2016-1520
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com