CVE-2020-5739CWE-94

Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker adds an OpenVPN up script to…

published April 14, 2020

CVSS
—
EPSS
5%
Percentile
92.6
In the wild
Unconfirmed
What it is

Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker adds an OpenVPN up script to the phone's VPN settings via the "Additional Settings" field in the web interface. When the VPN's connection is established, the user defined script is executed with root privileges.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.05339 · 92.6th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2020-04-14T13:48Z
EPSS history
Timeline
  • 14 APR 13:48Z
    Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker adds an OpenVPN up script to…
    cvelistv5