CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2021-37748
High (8.8) in grandstream ht801 firmware. EPSS 7.4% chance of exploitation in the next 30 days.
Multiple buffer overflows in the limited configuration shell (/sbin/gs_config) on Grandstream HT801 devices before 1.0.29 allow remote authenticated users to execute arbitrary code as root via a crafted manage_if setting, thus bypassing the intended restrictions of this shell and taking full control of the device. There are default weak credentials that can be used to authenticate.
Severity
- EPSS
- 7.4% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-31)
- CWE
- CWE-787
- Published
- Modified
- Record from
- the NVD, synced
Affected
- grandstream:ht801_firmware
References
- http://www.grandstream.com/products/gateways-and-atas/analog-telephone-adaptors/product/ht801
- https://github.com/SECFORCE/CVE-2021-37748
- https://www.secforce.com/blog/exploiting-grandstream-ht801-ata-cve-2021-37748-cve-2021-37915/
- http://www.grandstream.com/products/gateways-and-atas/analog-telephone-adaptors/product/ht801
- https://github.com/SECFORCE/CVE-2021-37748