CVE-2020-5739: Code Injection
Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker adds an OpenVPN up script to the phone's VPN settings via the "Additional Settings" field in the web interface. When the VPN's connection is established, the user defined script is executed with root privileges.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-5739?
CVE-2020-5739 is a vulnerability in the Grandstream GXP1600 series firmware 1.0.4.152 and below that allows authenticated remote command execution.
How can an attacker exploit CVE-2020-5739?
An attacker can exploit CVE-2020-5739 by adding an OpenVPN up script to the phone's VPN settings via the "Additional Settings" field in the web interface.
What is the severity rating of CVE-2020-5739?
CVE-2020-5739 has a severity rating of 8.8, which is considered critical.
Which versions of Grandstream GXP1600 series firmware are affected?
Grandstream GXP1600 series firmware 1.0.4.152 and below are affected by CVE-2020-5739.
Is Grandstream GXP1610 vulnerable to CVE-2020-5739?
No, Grandstream GXP1610 is not vulnerable to CVE-2020-5739.