CVE-2020-5739: Code Injection
First published: Tue Apr 14 2020(Updated: )
Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker adds an OpenVPN up script to the phone's VPN settings via the "Additional Settings" field in the web interface. When the VPN's connection is established, the user defined script is executed with root privileges.
Credit: vulnreport@tenable.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Grandstream Gxp1610 Firmware | <=1.0.4.152 | |
| Grandstream Gxp1610 | ||
| Grandstream Gxp1615 Firmware | <=1.0.4.152 | |
| Grandstream Gxp1615 | ||
| Grandstream Gxp1620 Firmware | <=1.0.4.152 | |
| Grandstream Gxp1620 | ||
| Grandstream Gxp1625 Firmware | <=1.0.4.152 | |
| Grandstream Gxp1625 | ||
| Grandstream Gxp1628 Firmware | <=1.0.4.152 | |
| Grandstream Gxp1628 | ||
| Grandstream Gxp1630 Firmware | <=1.0.4.152 | |
| Grandstream Gxp1630 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-5739?
CVE-2020-5739 is a vulnerability in the Grandstream GXP1600 series firmware 1.0.4.152 and below that allows authenticated remote command execution.
How can an attacker exploit CVE-2020-5739?
An attacker can exploit CVE-2020-5739 by adding an OpenVPN up script to the phone's VPN settings via the "Additional Settings" field in the web interface.
What is the severity rating of CVE-2020-5739?
CVE-2020-5739 has a severity rating of 8.8, which is considered critical.
Which versions of Grandstream GXP1600 series firmware are affected?
Grandstream GXP1600 series firmware 1.0.4.152 and below are affected by CVE-2020-5739.
Is Grandstream GXP1610 vulnerable to CVE-2020-5739?
No, Grandstream GXP1610 is not vulnerable to CVE-2020-5739.
- collector/nvd-index
- agent/author
- agent/severity
- agent/references
- agent/weakness
- agent/type
- vendor/grandstream
- canonical/grandstream gxp1610 firmware
- version/grandstream gxp1610 firmware/1.0.4.152
- canonical/grandstream gxp1610
- canonical/grandstream gxp1615 firmware
- version/grandstream gxp1615 firmware/1.0.4.152
- canonical/grandstream gxp1615
- canonical/grandstream gxp1620 firmware
- version/grandstream gxp1620 firmware/1.0.4.152
- canonical/grandstream gxp1620
- canonical/grandstream gxp1625 firmware
- version/grandstream gxp1625 firmware/1.0.4.152
- canonical/grandstream gxp1625
- canonical/grandstream gxp1628 firmware
- version/grandstream gxp1628 firmware/1.0.4.152
- canonical/grandstream gxp1628
- canonical/grandstream gxp1630 firmware
- version/grandstream gxp1630 firmware/1.0.4.152
- canonical/grandstream gxp1630