CVE-2022-2070 Vulnerability Details

  /     /     /  

CVE-2022-2070 Metadata Quick Info

CVE Published: 23/09/2022 | CVE Updated: 16/09/2024 | CVE Year: 2022
Source: INCIBE | Vendor: Grandstream | Product: Grandstream GSD3710
Status : PUBLISHED

---

CVE-2022-2070 Description

In Grandstream GSD3710 in its 1.0.11.13 version, it\'s possible to overflow the stack since it doesn\'t check the param length before using the sscanf instruction. Because of that, an attacker could create a socket and connect with a remote IP:port by opening a shell and getting full access to the system. The exploit affects daemons dbmng and logsrv that are running on ports 8000 and 8001 by default.

Metrics

CVSS Version: 3.1 | Base Score: 9.8 CRITICAL
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* NONE
    User Interaction (UI)* NONE
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* HIGH
    Integrity Impact (I)* HIGH
    Availability Impact (A)* HIGH

Weakness Enumeration (CWE)

CWE-ID: CWE-121
CWE Name: CWE-121 Stack-based Buffer Overflow
Source: Grandstream

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).