Vulnerability Details CVE-2021-37915
An issue was discovered on the Grandstream HT801 Analog Telephone Adaptor before 1.0.29.8. From the limited configuration shell, it is possible to set the malicious gdb_debug_server variable. As a result, after a reboot, the device downloads and executes malicious scripts from an attacker-defined host.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.008
EPSS Ranking 72.2%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 9.0
References
- http://firmware.grandstream.com/BETA/Release_Note_HT80x_1.0.29.8.pdf
- http://www.grandstream.com/products/gateways-and-atas/analog-telephone-adaptors/product/ht801
- https://www.secforce.com/blog/exploiting-grandstream-ht801-ata-cve-2021-37748-cve-2021-37915/
- http://firmware.grandstream.com/BETA/Release_Note_HT80x_1.0.29.8.pdf
- http://www.grandstream.com/products/gateways-and-atas/analog-telephone-adaptors/product/ht801
- https://www.secforce.com/blog/exploiting-grandstream-ht801-ata-cve-2021-37748-cve-2021-37915/
Products affected by CVE-2021-37915
-
cpe:2.3:h:grandstream:ht801:-
-
cpe:2.3:o:grandstream:ht801_firmware:-
-
cpe:2.3:o:grandstream:ht801_firmware:1.0.17.5
-
cpe:2.3:o:grandstream:ht801_firmware:1.0.29