CVE-2020-5756
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: NVD
Description
Grandstream GWN7000 firmware version 1.0.9.4 and below allows authenticated remote users to modify the system's crontab via undocumented API. An attacker can use this functionality to execute arbitrary OS commands on the router.
Affected (1)
Products: Grandstream: Gwn7000 Firmware
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 1.0.9.4 |
| Running on/with | Platform Versions |
|---|---|
Grandstream Gwn7000 | All versions |
Related CWEs
CWE-489
Active Debug Code
The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
References (3)
Source: af854a3a-2127-422b-91ae-364da2661108
Not Applicable
Timeline
No history available yet.