Vulnerability Description
In Grandstream GSD3710 in its 1.0.11.13 version, it's possible to overflow the stack since it doesn't check the param length before using the sscanf instruction. Because of that, an attacker could create a socket and connect with a remote IP:port by opening a shell and getting full access to the system. The exploit affects daemons dbmng and logsrv that are running on ports 8000 and 8001 by default.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Grandstream | Gds3710 Firmware | 1.0.11.13 |
| Grandstream | Gds3710 | - |
Related Weaknesses (CWE)
References
- https://www.incibe-cert.es/en/early-warning/security-advisories/buffer-overflow-Third Party Advisory
- https://www.incibe-cert.es/en/early-warning/security-advisories/buffer-overflow-Third Party Advisory
FAQ
What is CVE-2022-2070?
CVE-2022-2070 is a vulnerability with a CVSS score of 9.8 (CRITICAL). In Grandstream GSD3710 in its 1.0.11.13 version, it's possible to overflow the stack since it doesn't check the param length before using the sscanf instruction. Because of that, an attacker could cre...
How severe is CVE-2022-2070?
CVE-2022-2070 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2022-2070?
Check the references section above for vendor advisories and patch information. Affected products include: Grandstream Gds3710 Firmware, Grandstream Gds3710.