VulnerabilityModified

CVE-2022-2025

an attacker with knowledge of user/pass of Grandstream GSD3710 in its 1.0.11.13 version, could overflow the stack since it doesn't check the param length before use the strcopy instruction.

CRITICAL 9.8EPSS 4.45%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (4.45%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

an attacker with knowledge of user/pass of Grandstream GSD3710 in its 1.0.11.13 version, could overflow the stack since it doesn't check the param length before use the strcopy instruction. The explotation of this vulnerability may lead an attacker to execute a shell with full access.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 4.45% probability · 91th percentile
CISA KEV: Not listed
Weakness: CWE-121, CWE-787
Affected: grandstream/gds3710 firmware
Source: cve-coordination@incibe.es

References

https://www.incibe-cert.es/en/early-warning/security-advisories/buffer-overflow-vulnerabilities-grandstream-gsd3710Third Party Advisory
https://www.incibe-cert.es/en/early-warning/security-advisories/buffer-overflow-vulnerabilities-grandstream-gsd3710Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.