CVE-2018-17565: OS Command Injection

Published Apr 1, 2019

Updated

Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute arbitrary system commands and gain a root shell.

Affected Software

12 affected components

Grandstream Gxp1610 Firmware=1.0.4.128

Grandstream GXP1610

Grandstream Gxp1615 Firmware=1.0.4.128

Grandstream GXP1615

Grandstream Gxp1620 Firmware=1.0.4.128

Grandstream GXP1620

Grandstream Gxp1625 Firmware=1.0.4.128

Grandstream GXP1625

Grandstream Gxp1628 Firmware=1.0.4.128

Grandstream GXP1628

Grandstream Gxp1630 Firmware=1.0.4.128

Grandstream GXP1630

Event History

Apr 1, 2019

CVE Published

via MITRE·08:51 PM

Data Sourced

via MITRE·08:51 PM

Description

Frequently Asked Questions

What is CVE-2018-17565?

CVE-2018-17565 is a vulnerability that allows attackers to execute arbitrary system commands and gain a root shell on Grandstream GXP16xx VoIP 1.0.4.128 phones.

How severe is CVE-2018-17565?

CVE-2018-17565 has a severity rating of 9.8, which is considered critical.

Which software versions are affected by CVE-2018-17565?

Grandstream GXP16xx VoIP phones running firmware version 1.0.4.128 are affected by CVE-2018-17565.

How can attackers exploit CVE-2018-17565?

Attackers can exploit CVE-2018-17565 by injecting shell metacharacters in the SSH configuration interface, allowing them to execute arbitrary system commands.

How can I fix CVE-2018-17565?

To fix CVE-2018-17565, it is recommended to update the firmware of the affected Grandstream GXP16xx VoIP phones to a version that is not vulnerable.