CVE-2020-5760: OS Command Injection
First published: Wed Jul 29 2020(Updated: )
Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to an OS command injection vulnerability. Unauthenticated remote attackers can execute arbitrary commands as root by crafting a special configuration file and sending a crafted SIP message.
Credit: vulnreport@tenable.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Grandstream HT801 Firmware | <=1.0.17.5 | |
| Grandstream HT801 Firmware | ||
| Grandstream HT802 Firmware | <=1.0.17.5 | |
| Grandstream HT802 Firmware | ||
| Grandstream HT812 Firmware | <=1.0.17.5 | |
| Grandstream HT812 Firmware | ||
| Grandstream HT814 Firmware | <=1.0.17.5 | |
| Grandstream HT814 Firmware | ||
| Grandstream HT818 Firmware | <=1.0.17.5 | |
| Grandstream HT818 | ||
| Grandstream HT813 Firmware | <=1.0.17.5 | |
| Grandstream HT813 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-5760?
CVE-2020-5760 is a vulnerability in Grandstream HT800 series firmware version 1.0.17.5 and below that allows unauthenticated remote attackers to execute arbitrary commands as root.
How can an attacker exploit CVE-2020-5760?
An attacker can exploit CVE-2020-5760 by crafting a special configuration file and sending a crafted SIP message.
What is the severity of CVE-2020-5760?
The severity of CVE-2020-5760 is critical with a CVSS score of 7.8.
Which versions of Grandstream HT800 series firmware are affected by CVE-2020-5760?
Grandstream HT800 series firmware version 1.0.17.5 and below are affected by CVE-2020-5760.
Are all models of Grandstream HT800 series vulnerable to CVE-2020-5760?
No, only the models with firmware version 1.0.17.5 and below are vulnerable to CVE-2020-5760.
- agent/references
- agent/weakness
- agent/last-modified-date
- agent/type
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/severity
- agent/author
- agent/first-publish-date
- agent/description
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/grandstream
- canonical/grandstream ht801 firmware
- version/grandstream ht801 firmware/1.0.17.5
- canonical/grandstream ht802 firmware
- version/grandstream ht802 firmware/1.0.17.5
- canonical/grandstream ht812 firmware
- version/grandstream ht812 firmware/1.0.17.5
- canonical/grandstream ht814 firmware
- version/grandstream ht814 firmware/1.0.17.5
- canonical/grandstream ht818 firmware
- version/grandstream ht818 firmware/1.0.17.5
- canonical/grandstream ht818
- canonical/grandstream ht813 firmware
- version/grandstream ht813 firmware/1.0.17.5
- canonical/grandstream ht813