CVE-2020-25218

Published: Mar 29, 2021Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Grandstream GRP261x VoIP phone running firmware version 1.0.3.6 (Base) allow Authentication Bypass in its administrative web interface.

Affected (7)

Products: Grandstream: Grp2612 Firmware, Grp2612p Firmware, Grp2612w Firmware, Grp2613 Firmware, Grp2614 Firmware, Grp2615 Firmware, Grp2616 Firmware

7 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Grandstream Grp2612 Firmware	Version 1.0.3.6

Running on/with	Platform Versions
Grandstream Grp2612	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Grandstream Grp2612p Firmware	Version 1.0.3.6

Running on/with	Platform Versions
Grandstream Grp2612p	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Grandstream Grp2612w Firmware	Version 1.0.3.6

Running on/with	Platform Versions
Grandstream Grp2612w	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Grandstream Grp2613 Firmware	Version 1.0.3.6

Running on/with	Platform Versions
Grandstream Grp2613	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Grandstream Grp2614 Firmware	Version 1.0.3.6

Running on/with	Platform Versions
Grandstream Grp2614	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Grandstream Grp2615 Firmware	Version 1.0.3.6

Running on/with	Platform Versions
Grandstream Grp2615	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Grandstream Grp2616 Firmware	Version 1.0.3.6

Running on/with	Platform Versions
Grandstream Grp2616	All versions

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (4)

https://cwe.mitre.org/data/definitions/306.html

Source: cve@mitre.org

Third Party Advisory

https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2021-0002/FEYE-2021-0002.md

Source: cve@mitre.org

Third Party Advisory

https://cwe.mitre.org/data/definitions/306.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://github.com/fireeye/Vulnerability-Disclosures/blob/master/FEYE-2021-0002/FEYE-2021-0002.md

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.