CVE-2021-37748

Multiple buffer overflows in the limited configuration shell (/sbin/gs_config) on Grandstream HT801 devices before 1.0.29 allow remote authenticated users to execute arbitrary code as root via a crafted manage_if setting, thus bypassing the intended restrictions of this shell and taking full control of the device. There are default weak credentials that can be used to authenticate.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

7.41% chance of exploitation in the next 30 days, 94th percentile

Published

2021-10-28

Updated

2024-08-04

Proof-of-concept exploits (2)

• https://www.secforce.com/blog/exploiting-grandstream-ht801-ata-cve-2021-37748-cve-2021-37…
• SECFORCE/CVE-2021-377485★ · 2021-10-25

References

• CVE Record
• NVD entry

Related

• CVE-2008-1613
• CVE-2008-5416
• CVE-2011-3368
• CVE-2011-4107
• CVE-2017-3599
• CVE-2018-8941