CVE-2024-32937CWE-78
An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of Grandstream GXP2135 1.0.9.129, 1.0.11.74 and 1.0.11.79
High · published July 3, 2024
What it is
An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of Grandstream GXP2135 1.0.9.129, 1.0.11.74 and 1.0.11.79. A specially crafted network packet can lead to arbitrary command execution. An attacker can send a sequence of malicious packets to trigger this vulnerability.
The record
Technical detail
- CVSS v3.1
- 8.1 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.26958 · 98.0th percentile
- Weakness
- CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- Published
- 2024-07-03T14:05Z
EPSS history
Timeline