Critical severity · published Dec 11, 2019
CVE-2013-3542
Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP_HD, GXV3500, and possibly other camera models with firmware…
10.0
CVSS
2.6%
EPSS
No
On KEV
Description
Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP_HD, GXV3500, and possibly other camera models with firmware 1.0.4.11, have a hardcoded account "!#/" with the same password, which makes it easier for remote attackers to obtain access via a TELNET session.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GF
Gxv3500 Firmware · Grandstream
1.0.4.11 · source: NVD
GF
Gxv3501 Firmware · Grandstream
1.0.4.11 · source: NVD
GF
Gxv3504 Firmware · Grandstream
1.0.4.11 · source: NVD
GF
Gxv3601 Firmware · Grandstream
1.0.4.11 · source: NVD
GF
Gxv3601hd Firmware · Grandstream
1.0.4.11 · source: NVD
GF
Gxv3601ll Firmware · Grandstream
1.0.4.11 · source: NVD
GF
Gxv3611hd Firmware · Grandstream
1.0.4.11 · source: NVD
GF
Gxv3611ll Firmware · Grandstream
1.0.4.11 · source: NVD
GF
Gxv3615p Firmware · Grandstream
1.0.4.11 · source: NVD
GF
Gxv3615w Firmware · Grandstream
1.0.4.11 · source: NVD
GH
Gxv3615wp HD Firmware · Grandstream
1.0.4.11 · source: NVD
GF
Gxv3651fhd Firmware · Grandstream
1.0.4.11 · source: NVD