CVE-2020-5738
First published: Tue Apr 14 2020(Updated: )
Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker uploads a specially crafted tar file to the HTTP /cgi-bin/upload_vpntar interface.
Credit: vulnreport@tenable.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Grandstream Gxp1610 Firmware | <=1.0.4.152 | |
| Grandstream Gxp1610 Firmware | ||
| Grandstream Gxp1615 Firmware | <=1.0.4.152 | |
| Grandstream GXP1615 | ||
| Grandstream Gxp1620 Firmware | <=1.0.4.152 | |
| Grandstream Gxp1620 Firmware | ||
| Grandstream Gxp1625 Firmware | <=1.0.4.152 | |
| Grandstream Gxp1625 Firmware | ||
| Grandstream Gxp1628 Firmware | <=1.0.4.152 | |
| Grandstream Gxp1628 Firmware | ||
| Grandstream Gxp1630 Firmware | <=1.0.4.152 | |
| Grandstream Gxp1630 Firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-5738?
CVE-2020-5738 is a vulnerability in Grandstream GXP1600 series firmware 1.0.4.152 and below that allows authenticated remote command execution.
How can an attacker exploit CVE-2020-5738?
An attacker can exploit CVE-2020-5738 by uploading a specially crafted tar file to the HTTP /cgi-bin/upload_vpntar interface.
What is the severity of CVE-2020-5738?
CVE-2020-5738 has a severity rating of 8.8 (Critical).
Which software versions are affected by CVE-2020-5738?
Grandstream GXP1600 series firmware 1.0.4.152 and below are affected by CVE-2020-5738.
Is Grandstream GXP1610 vulnerable to CVE-2020-5738?
No, Grandstream GXP1610 is not vulnerable to CVE-2020-5738.
- agent/author
- agent/tags
- agent/event
- agent/type
- agent/last-modified-date
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/weakness
- agent/severity
- agent/references
- agent/first-publish-date
- agent/description
- vendor/grandstream
- canonical/grandstream gxp1610 firmware
- version/grandstream gxp1610 firmware/1.0.4.152
- canonical/grandstream gxp1615 firmware
- version/grandstream gxp1615 firmware/1.0.4.152
- canonical/grandstream gxp1615
- canonical/grandstream gxp1620 firmware
- version/grandstream gxp1620 firmware/1.0.4.152
- canonical/grandstream gxp1625 firmware
- version/grandstream gxp1625 firmware/1.0.4.152
- canonical/grandstream gxp1628 firmware
- version/grandstream gxp1628 firmware/1.0.4.152
- canonical/grandstream gxp1630 firmware
- version/grandstream gxp1630 firmware/1.0.4.152