CVE-2018-17564
A Malformed Input String to /cgi-bin/delete_CA on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to delete configuration parameters and gain admin access to the device.
- Score
- CVSS 3.0 9.8 Critical
- Status
- Modified - cve@mitre.org
- Published
- 2019-04-01
- Last modified
- 2024-08-05
Affected products
- Gxp1610 Firmware (Grandstream)
- Gxp1615 Firmware (Grandstream)
- Gxp1620 Firmware (Grandstream)
- Gxp1625 Firmware (Grandstream)
- Gxp1628 Firmware (Grandstream)
- Gxp1630 Firmware (Grandstream)
References
- http://grandstream.com/support/firmware
- https://iridiumxor.wordpress.com/2019/01/03/three-simple-cves-for-a-good-voip-phone/
