QwikSec

Security Database

CVE

CWE

Training

CVE-2021-37915

Published: Oct 28, 2021

Modified: Aug 4, 2024

PUBLISHED

Description

An issue was discovered on the Grandstream HT801 Analog Telephone Adaptor before 1.0.29.8. From the limited configuration shell, it is possible to set the malicious gdb_debug_server variable. As a result, after a reboot, the device downloads and executes malicious scripts from an attacker-defined host.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

http://www.grandstream.com/products/gateways-and-atas/analog-telephone-adaptors/product/ht801

x_refsource_MISC

http://firmware.grandstream.com/BETA/Release_Note_HT80x_1.0.29.8.pdf

x_refsource_MISC

https://www.secforce.com/blog/exploiting-grandstream-ht801-ata-cve-2021-37748-cve-2021-37915/

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.