Wave

wave

Vendor: Grandstream • 3 CVEs

CVEs (3)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2016-1520 1Grandstream 1Wave May 13, 2026 Apr 21, 2017 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 The Grandstream Wave app 1.0.1.26 and earlier for Android does not use HTTPS when retrieving update information, which might allow man-in-the-middle attackers to execute arbitrary code via a crafted application.
CVE-2016-1519 1Grandstream 1Wave May 13, 2026 Apr 21, 2017 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validate SSL certificates, which allows man-in-the-middle attackers to spoof the Grandstream provisioning se...Show more The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validate SSL certificates, which allows man-in-the-middle attackers to spoof the Grandstream provisioning server via a crafted certificate.Show less
CVE-2016-1518 1Grandstream 1Wave May 13, 2026 Apr 21, 2017 N/A· v4 8.1 HIGH· v3 6.8 MEDIUM· v2 The auto-provisioning mechanism in the Grandstream Wave app 1.0.1.26 and earlier for Android and Grandstream Video IP phones allows man-in-the-middle attackers to spoof provisioning data and consequently modify device fu...Show more The auto-provisioning mechanism in the Grandstream Wave app 1.0.1.26 and earlier for Android and Grandstream Video IP phones allows man-in-the-middle attackers to spoof provisioning data and consequently modify device functionality, obtain sensitive information from system logs, and have unspecified other impact by leveraging failure to use an HTTPS session for downloading configuration files from http://fm.grandstream.com/gs/.Show less