CVE-2021-37748

Katalog CVE

CVSS 8.8 · High EPSS 7,4%

Kerentanan Out-of-bounds Write pada grandstream ht801 firmware. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Multiple buffer overflows in the limited configuration shell (/sbin/gs_config) on Grandstream HT801 devices before 1.0.29 allow remote authenticated users to execute arbitrary code as root via a crafted manage_if setting, thus bypassing the intended restrictions of this shell and taking full control of the device. There are default weak credentials that can be used to authenticate.

Rincian

Terbit di NVD

28 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-787: Out-of-bounds Write

EPSS (30 hari)

7,4% peluang dieksploitasi; lebih tinggi dari 94,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.grandstream.com/products/gateways-and-atas/analog-telephone-adaptors/product/ht801 product · advisory vendor
• https://github.com/SECFORCE/CVE-2021-37748 advisory pihak ketiga
• https://www.secforce.com/blog/exploiting-grandstream-ht801-ata-cve-2021-37748-cve-2021-37915/ exploit · advisory pihak ketiga