CVE-2017-16564

5.4 mediumEPSS 0.6%

Medium (5.4) in grandstream ht802 firmware. EPSS 0.6% chance of exploitation in the next 30 days.

Stored Cross-site scripting (XSS) vulnerability in /cgi-bin/config2 on Vonage (Grandstream) HT802 devices allows remote authenticated users to inject arbitrary web script or HTML via the DHCP vendor class ID field (P148).

Severity

CVSS 3.0

5.4 medium

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2017-11-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

grandstream:ht802_firmware

References

https://distributedcompute.com/2017/11/04/vonage-ht802-multiple-vulnerabilities/
https://distributedcompute.com/2017/11/04/vonage-ht802-multiple-vulnerabilities/

Check your stack JSON