CVE-2019-10656: OS Command Injection
Grandstream GWN7000 before 1.0.6.32 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the filename in a /ubus/uci.apply updatendswebrootfromtmp API call.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-10656?
CVE-2019-10656 is a vulnerability that allows remote authenticated users to execute arbitrary code on Grandstream GWN7000 devices.
How severe is CVE-2019-10656?
CVE-2019-10656 has a severity rating of 8.8 on the CVSS scale, indicating it is a critical vulnerability.
What is affected by CVE-2019-10656?
Grandstream GWN7000 devices with firmware up to and including version 1.0.6.32 are affected by CVE-2019-10656.
How can remote authenticated users exploit CVE-2019-10656?
Remote authenticated users can exploit CVE-2019-10656 by using shell metacharacters in the filename in a specific API call.
Is there a fix for CVE-2019-10656?
To fix CVE-2019-10656, update the Grandstream GWN7000 firmware to version 1.0.6.33 or later.