Unrated severityNVD Advisory· Published Oct 28, 2021· Updated Aug 4, 2024

CVE-2021-37748

Description

Multiple buffer overflows in the limited configuration shell (/sbin/gs_config) on Grandstream HT801 devices before 1.0.29 allow remote authenticated users to execute arbitrary code as root via a crafted manage_if setting, thus bypassing the intended restrictions of this shell and taking full control of the device. There are default weak credentials that can be used to authenticate.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Grandstream/HT801description
Grandstream/HT801llm-fuzzy
Range: < 1.0.29

Patches

Vulnerability mechanics

References

www.grandstream.com/products/gateways-and-atas/analog-telephone-adaptors/product/ht801mitrex_refsource_MISC
www.secforce.com/blog/exploiting-grandstream-ht801-ata-cve-2021-37748-cve-2021-37915/mitrex_refsource_MISC

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.006
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000