CVE-2018-17565: OS Command Injection
First published: Mon Apr 01 2019(Updated: )
Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute arbitrary system commands and gain a root shell.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Grandstream Gxp1610 Firmware | =1.0.4.128 | |
| Grandstream Gxp1610 | ||
| Grandstream Gxp1615 Firmware | =1.0.4.128 | |
| Grandstream Gxp1615 | ||
| Grandstream Gxp1620 Firmware | =1.0.4.128 | |
| Grandstream Gxp1620 | ||
| Grandstream Gxp1625 Firmware | =1.0.4.128 | |
| Grandstream Gxp1625 | ||
| Grandstream Gxp1628 Firmware | =1.0.4.128 | |
| Grandstream Gxp1628 | ||
| Grandstream Gxp1630 Firmware | =1.0.4.128 | |
| Grandstream Gxp1630 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2018-17565?
CVE-2018-17565 is a vulnerability that allows attackers to execute arbitrary system commands and gain a root shell on Grandstream GXP16xx VoIP 1.0.4.128 phones.
How severe is CVE-2018-17565?
CVE-2018-17565 has a severity rating of 9.8, which is considered critical.
Which software versions are affected by CVE-2018-17565?
Grandstream GXP16xx VoIP phones running firmware version 1.0.4.128 are affected by CVE-2018-17565.
How can attackers exploit CVE-2018-17565?
Attackers can exploit CVE-2018-17565 by injecting shell metacharacters in the SSH configuration interface, allowing them to execute arbitrary system commands.
How can I fix CVE-2018-17565?
To fix CVE-2018-17565, it is recommended to update the firmware of the affected Grandstream GXP16xx VoIP phones to a version that is not vulnerable.
- collector/nvd-index
- agent/author
- agent/weakness
- agent/references
- agent/severity
- agent/description
- agent/type
- agent/event
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/grandstream
- canonical/grandstream gxp1610 firmware
- version/grandstream gxp1610 firmware/1.0.4.128
- canonical/grandstream gxp1610
- canonical/grandstream gxp1615 firmware
- version/grandstream gxp1615 firmware/1.0.4.128
- canonical/grandstream gxp1615
- canonical/grandstream gxp1620 firmware
- version/grandstream gxp1620 firmware/1.0.4.128
- canonical/grandstream gxp1620
- canonical/grandstream gxp1625 firmware
- version/grandstream gxp1625 firmware/1.0.4.128
- canonical/grandstream gxp1625
- canonical/grandstream gxp1628 firmware
- version/grandstream gxp1628 firmware/1.0.4.128
- canonical/grandstream gxp1628
- canonical/grandstream gxp1630 firmware
- version/grandstream gxp1630 firmware/1.0.4.128
- canonical/grandstream gxp1630