PT-2019-9505 · Grandstream · Grandstream Gxp16Xx Voip

Iridiumxor

·

CVE-2018-17564

·

Published

2019-04-01

·

Updated

2020-08-24

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Grandstream GXP16xx VoIP version 1.0.4.128
Description The issue arises from a malformed input string sent to the "/cgi-bin/delete CA" API endpoint, allowing attackers to delete configuration parameters and gain admin access to the device.
Recommendations For Grandstream GXP16xx VoIP version 1.0.4.128, as a temporary workaround, consider restricting access to the "/cgi-bin/delete CA" API endpoint until a patch is available.

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

CVE-2018-17564

Affected Products

Grandstream Gxp16Xx Voip