High severity · published Jul 17, 2020
CVE-2020-5756
Grandstream GWN7000 firmware version 1.0.9.4 and below allows authenticated remote users to modify the system's crontab via undocumented API
8.8
CVSS
2.5%
EPSS
No
On KEV
Description
Grandstream GWN7000 firmware version 1.0.9.4 and below allows authenticated remote users to modify the system's crontab via undocumented API. An attacker can use this functionality to execute arbitrary OS commands on the router.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GF
Gwn7000 Firmware · Grandstream
through 1.0.9.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-5756
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-5756
Not Applicable
https://www.tenable.com/security/research/tra-2020-41
Exploit
https://www.tenable.com/cve/CVE-2020-5756
More from Gwn7000 Firmware
8.8
CVE-2019-10656
Grandstream GWN7000 before 1.0.6.32 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the filename in a /ubus/uci.apply…
6.5
CVE-2019-10657
Grandstream GWN7000 before 1.0.6.32 and GWN7610 before 1.0.8.18 devices allow remote authenticated users to discover passwords via a /ubus/uci.apply config request