{"id":"CVE-2019-10655","published":"2019-03-30T16:42:06Z","modified":"2024-08-04T22:32:01Z","title":"Grandstream GAC2500 1.0.3.35, GXP2200 1.0.3.27, GVC3202 1.0.3.51, GXV3275 before 1.0.3.219 Beta, and GXV3240 before…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"Grandstream GAC2500 1.0.3.35, GXP2200 1.0.3.27, GVC3202 1.0.3.51, GXV3275 before 1.0.3.219 Beta, and GXV3240 before 1.0.3.219 Beta devices allow unauthenticated remote code execution via shell metacharacters in a /manager?action=getlogcat priority field, in conjunction with a buffer overflow (via the phonecookie cookie) to overwrite a data structure and consequently bypass authentication. This can be exploited remotely or via CSRF because the cookie can be placed in an Accept HTTP header in an XMLHttpRequest call to lighttpd.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":null,"epss":{"score":0.15475,"percentile":0.96793,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2020-10-14","exploitedFirstSeen":"2020-10-14","ransomware":false,"evidence":[{"url":"https://unit42.paloaltonetworks.com/iot-vulnerabilities-mirai-payloads/","date":"2020-10-14"},{"url":"https://www.microsoft.com/en-us/security/blog/2022/12/21/microsoft-research-uncovers-new-zerobot-capabilities/","date":"2022-12-21"},{"url":"https://fortiguard.fortinet.com/threat-signal-report/4926/new-zerobot-variant-exploits-additional-vulnerabilities-for-propagation","date":"2022-12-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-04&host_type=src&vulnerability=cve-2019-10655","date":"2026-09-04"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-05&host_type=src&vulnerability=cve-2019-10655","date":"2026-09-05"},{"url":"https://previdian.com/CVE-2019-10655","date":"2026-09-05"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-06&host_type=src&vulnerability=cve-2019-10655","date":"2026-09-06"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-07&host_type=src&vulnerability=cve-2019-10655","date":"2026-09-07"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-08&host_type=src&vulnerability=cve-2019-10655","date":"2026-09-08"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-09&host_type=src&vulnerability=cve-2019-10655","date":"2026-09-09"}],"evidenceTotal":19,"provenance":"source"},"exploited":true,"otx":{"pulseCount":10,"pulses":[{"name":"DDoS Botnet, ZeroBot, Adds to its Capabilities","url":"https://otx.alienvault.com/pulse/63ac9a9b47285cdeaac87628","created":"2022-12-28"},{"name":"Microsoft research uncovers new Zerobot capabilities","url":"https://otx.alienvault.com/pulse/63a97aca4939331148964839","created":"2022-12-26"},{"name":"Microsoft research uncovers new Zerobot capabilities - Microsoft Security Blog","url":"https://otx.alienvault.com/pulse/63a5bd9e4b819d29d7b8f94c","created":"2022-12-23"},{"name":"Microsoft research uncovers new Zerobot capabilities","url":"https://otx.alienvault.com/pulse/63a5ae13d4a3401905954b4a","created":"2022-12-23"},{"name":"Microsoft research uncovers new Zerobot capabilities - Microsoft Security Blog","url":"https://otx.alienvault.com/pulse/63a5366d09707e5927d950b9","created":"2022-12-23"},{"name":"Microsoft research uncovers new Zerobot capabilities - Microsoft Security Blog","url":"https://otx.alienvault.com/pulse/63a4721874292cc0afb8a687","created":"2022-12-22"},{"name":"Zerobot Botnet Emerges as a Growing Threat with New Exploits and Capabilities","url":"https://otx.alienvault.com/pulse/63a456549775cb8accfd95dc","created":"2022-12-22"},{"name":"Zerobot Malware Now Exploits Apache Vulnerabilities","url":"https://otx.alienvault.com/pulse/63a44768c57d4c8dfbdc77f7","created":"2022-12-22"},{"name":"Microsoft research uncovers new Zerobot capabilities - Microsoft Security Blog","url":"https://otx.alienvault.com/pulse/63a41dfc05aa84684084441f","created":"2022-12-22"},{"name":"Two New IoT Vulnerabilities Identified with Mirai Payloads","url":"https://otx.alienvault.com/pulse/5f886574bcc896392e1f2b6a","created":"2020-10-15"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=23920&dl=1","tags":["x_refsource_MISC"]},{"url":"https://github.com/scarvell/grandstream_exploits","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/165643/Grandstream-GXV3175-Unauthenticated-Command-Execution.html","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/165931/Grandstream-GXV31XX-settimezone-Unauthenticated-Command-Execution.html","tags":["x_refsource_MISC"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"machine","basis":"dataset-annotation","bases":["dataset-annotation"],"basisDetail":"TRAM2 annotated sentence label","mappingType":null,"evidence":[{"reportId":"SRC-b3ea000916d84bc1c41a","quote":"softwareCVE-2017-17105Zivif PR115-204-P-RSCVE-2019-10655GrandstreamCVE-2020-25223WebAdmin of Sophos SG UTMCVE-2021-42013ApacheCVE-2022-31137Roxy-WICVE-2022-33891Apache SparkZSL-2022-5717MiniDVBLinuxSince the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin","start":4458,"end":4753},{"reportId":"SRC-b3ea000916d84bc1c41a","quote":"of Sophos SG UTMCVE-2021-42013ApacheCVE-2022-31137Roxy-WICVE-2022-33891Apache SparkZSL-2022-5717MiniDVBLinuxSince the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin vulnerability that could allow threat actors to view or execute files.","start":4548,"end":4824}],"confidence":"low","confidenceNote":"machine-matched from report text"}],"reports":[{"id":"SRC-b3ea000916d84bc1c41a","title":"Microsoft research uncovers new Zerobot capabilities","publisher":"microsoft.com","url":"http://www.microsoft.com/en-us/security/blog/2022/12/21/microsoft-research-uncovers-new-zerobot-capabilities/","date":null,"mentions":[{"quote":"softwareCVE-2017-17105Zivif PR115-204-P-RSCVE-2019-10655GrandstreamCVE-2020-25223WebAdmin of Sophos SG UTMCVE-2021-42013ApacheCVE-2022-31137Roxy-WICVE-2022-33891Apache SparkZSL-2022-5717MiniDVBLinuxSince the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin","start":4458,"end":4753},{"quote":"CVE-2019-10655","start":12046,"end":12060},{"quote":"CVE-2019-10655","start":13284,"end":13298}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-2455","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-2455","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"Grandstream GXV31XX 'settimezone' Unauthenticated Command Execution","module":"exploit/linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_exec","type":"exploit","disclosureDate":"2016-09-01","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_exec.rb"}],"first":{"date":"2016-09-01","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_exec.rb"},"provenance":"source"},"exploitRefs":["https://github.com/scarvell/grandstream_exploits","http://packetstormsecurity.com/files/165643/Grandstream-GXV3175-Unauthenticated-Command-Execution.html","http://packetstormsecurity.com/files/165931/Grandstream-GXV31XX-settimezone-Unauthenticated-Command-Execution.html"],"flow":[{"stage":"observed","techniques":["T1190"],"provenance":"machine","lowConfidence":true}],"timeline":[{"date":"2016-09-01","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_exec.rb","provenance":"source"},{"date":"2019-03-30","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-10655","provenance":"source"},{"date":"2020-10-14","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://unit42.paloaltonetworks.com/iot-vulnerabilities-mirai-payloads/","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":65.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2206 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.36,"detail":"percentile 0.9679"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD exploit links; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":2.36,"detail":"10 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}