Bugs in Grandstream Gear Lay Open SMBs to Range of Attacks

guest · Mar 26, 2019

Bugs in Grandstream Gear Lay Open SMBs to Range of Attacks
March 25, 2019
https://threatpost.com/grandstream-bugs-smbs-attacks/143141/

A series of both unauthenticated and authenticated remote code-execution vulnerabilities have been uncovered in a variety of Grandstream products for small to medium-sized businesses, including audio and video conferencing units, IP video phones, routers and IP PBXs.

According to Trustwave SpiderLabs research released on Monday and shared exclusively with Threatpost, compromising these devices can allow an attacker to start scanning, installing remote access trojans and attacking other machines on the network that would otherwise be inaccessible;
There are more than 135,000 of these devices quickly searchable on Shodan and publicly exposed, according to the research, with a large subset of them that are vulnerable. It’s also possible that other devices in the Grandstream portfolio contain bugs.
Exploitation
In the real world, these vulnerabilities (details of which are in the advisory) could be exploited in a few ways, according to the researcher. For one, an attack could be as simple as sending an HTTP request to a device on an internal network [...]
Click to expand...

guest · Aug 1, 2020

4 Unpatched Bugs Plague Grandstream ATAs for VoIP Users
July 31, 2020
https://threatpost.com/4-unpatched-bugs-grandstream-atas-voip/157927/

Multiple high-severity vulnerabilities in the Grandstream HT800 series of Analog Telephone Adaptors (ATAs) threaten home office and midrange users alike, with outages, eavesdropping and device takeover.

The HT800 series of ATAs is designed for everyone from home or small-office users to medium-sized businesses, looking to connect their analog telephone devices to a VoIP network, unified communications system or other IP-based communications infrastructure. According to analysis from Tenable, the models have four worrying flaws, all of them unpatched as of this writing.
Click to expand...

The bug tracked as CVE-2020-5760 (rating 7.8 out of 10 on the CvSS scale) could allow command injection during the provisioning process. Unauthenticated remote attackers can execute arbitrary commands as root by crafting a special configuration file and sending a crafted SIP message. [...] advisory, released this week.
Tenable also published a proof-of-concept exploit, which results in a root shell on the device, allowing full compromise.

Meanwhile, CVE-2020-5761 is an infinite loop problem in the TR-069 service (rated 7.5 out of 10 on the CvSS scale) that can result in CPU exhaustion.
The TR-069 service is also at the heart of the third issue, CVE-2020-5762 (rating 7.5 out of 10 on the CvSS scale).
And finally, CVE-2020-5763 (ranking 8.8 out of 10 on the CvSS scale) is a SSH backdoor allowing a root shell, first uncovered by Lorenzo Santina (BigNerd95) back in January.
Click to expand...

All for now remain unaddressed. Grandstream HT800 series current firmware version 1.0.17.5 and below is vulnerable to all four bugs.
“At the time of publication, no solution exists,” Tenable noted.
Click to expand...

Log in or Sign up

Bugs in Grandstream Gear Lay Open SMBs to Range of Attacks

guest Guest

guest Guest

Log in or Sign up

Bugs in Grandstream Gear Lay Open SMBs to Range of Attacks

guest Guest

guest Guest

Useful Searches