Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2022-2070— Grandstream GSD3710 Stack-based Buffer Overflow

Quick assessment

Affected
Grandstream Grandstream GSD3710
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Grandstream GSD3710是美国潮流网络（Grandstream）公司的一款高清视频门禁系统。 Grandstream GSD3710 1.0.11.13版本存在安全漏洞，该漏洞源于在使用 strcopy 指令之前不检查参数长度，攻击者利用该漏洞可以执行具有完全访问权限的 shell。

CVSS 9.8 · Critical EPSS 5.84% · P93

Public Exploits 1

ExploitDB · 1 EDB-52303 [remote]
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-2070

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Grandstream GSD3710 Stack-based Buffer Overflow
Source: CVE Program / CVE List V5
Vulnerability Description
In Grandstream GSD3710 in its 1.0.11.13 version, it's possible to overflow the stack since it doesn't check the param length before using the sscanf instruction. Because of that, an attacker could create a socket and connect with a remote IP:port by opening a shell and getting full access to the system. The exploit affects daemons dbmng and logsrv that are running on ports 8000 and 8001 by default.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
栈缓冲区溢出
Source: CVE Program / CVE List V5
Vulnerability Title
Grandstream GSD3710 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Grandstream GSD3710是美国潮流网络（Grandstream）公司的一款高清视频门禁系统。 Grandstream GSD3710 1.0.11.13版本存在安全漏洞，该漏洞源于在使用 strcopy 指令之前不检查参数长度，攻击者利用该漏洞可以执行具有完全访问权限的 shell。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Grandstream Grandstream GSD3710 1.0.11.13 -

II. Public POCs for CVE-2022-2070

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-2070

请登录查看更多情报信息。

Other References for CVE-2022-2070 (1)

IV. Related Vulnerabilities

Same product: Grandstream GSD3710
Same vendor: Grandstream
Same weakness: CWE-121

V. Comments for CVE-2022-2070

No comments yet

Leave a comment