CVE-2019-10655 – This vulnerability allows unauthenticated remot... (How to Fix)

Q: What is the severity of CVE-2019-10655?

CVE-2019-10655 has a CVSS score of 9.8 (CRITICAL). This vulnerability allows unauthenticated remote attackers to execute arbitrary commands on affected Grandstream devices by exploiting shell metacharacter injection and a buffer overflow. Attackers can bypass authentication via crafted HTTP requests, enabling full system compromise. Affected devices include Grandstream GAC2500, GXP2200, GVC3202, GXV3275, and GXV3240 with specific vulnerable firmware versions.

📋 TL;DR

This vulnerability allows unauthenticated remote attackers to execute arbitrary commands on affected Grandstream devices by exploiting shell metacharacter injection and a buffer overflow. Attackers can bypass authentication via crafted HTTP requests, enabling full system compromise. Affected devices include Grandstream GAC2500, GXP2200, GVC3202, GXV3275, and GXV3240 with specific vulnerable firmware versions.

💻 Affected Systems

Products:

Grandstream GAC2500
Grandstream GXP2200
Grandstream GVC3202
Grandstream GXV3275
Grandstream GXV3240

Versions: GAC2500 1.0.3.35, GXP2200 1.0.3.27, GVC3202 1.0.3.51, GXV3275 before 1.0.3.219 Beta, GXV3240 before 1.0.3.219 Beta

Operating Systems: Embedded Linux

Default Config Vulnerable: ⚠️ Yes

Notes: All default configurations are vulnerable. The exploit works via HTTP requests to the web interface.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete device takeover allowing installation of persistent backdoors, credential theft, lateral movement to internal networks, and use as botnet nodes.

🟠

Likely Case

Remote code execution leading to device compromise, data exfiltration, and use in DDoS attacks or cryptocurrency mining.

🟢

If Mitigated

Limited impact if devices are behind firewalls with strict inbound filtering and network segmentation.

🌐 Internet-Facing: HIGH - Devices exposed to the internet can be directly exploited without authentication.

🏢 Internal Only: MEDIUM - Internal exploitation requires initial access but can lead to lateral movement.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Multiple public exploit scripts exist. Exploitation requires sending crafted HTTP requests with shell metacharacters in the priority field and buffer overflow via phonecookie cookie.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: GXV3275/GXV3240: 1.0.3.219 Beta or later; other models: check vendor for specific patched versions

Vendor Advisory: https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=23920&dl=1

Restart Required: Yes

Instructions:

1. Download latest firmware from Grandstream support portal. 2. Log into device web interface. 3. Navigate to Maintenance > Upgrade. 4. Upload firmware file. 5. Reboot device after upgrade completes.

🔧 Temporary Workarounds

Network Segmentation

all

Isolate affected devices in separate VLANs with strict firewall rules.

Web Interface Restriction

linux

Block external access to device web interfaces using firewall rules.

iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP

🧯 If You Can't Patch

Implement strict network access controls to limit device exposure
Monitor for unusual outbound connections from affected devices

🔍 How to Verify

Check if Vulnerable:

Check firmware version via web interface at System Status > Product Information or via SSH if enabled.

Check Version:

curl -s http://device-ip/cgi-bin/api?action=getInfo | grep firmware

Verify Fix Applied:

Confirm firmware version is patched and test with known exploit scripts (in controlled environment).

📡 Detection & Monitoring

Log Indicators:

HTTP requests containing '/manager?action=getlogcat' with shell metacharacters
Unusual process execution in system logs

Network Indicators:

HTTP POST requests to /manager endpoint with crafted priority parameters
Unexpected outbound connections from devices

SIEM Query:

source="device-logs" AND uri="/manager" AND (priority="*" OR priority="|" OR priority=";")

📊 Metadata

CVE ID: CVE-2019-10655

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-78

Published: March 30, 2019

Last Updated: November 21, 2024

🔗 References

http://packetstormsecurity.com/files/165643/Grandstream-GXV3175-Unauthenticated-Command-Execution.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165931/Grandstream-GXV31XX-settimezone-Unauthenticated-Command-Execution.html Exploit,Third Party Advisory,VDB Entry
https://github.com/scarvell/grandstream_exploits Exploit,Third Party Advisory
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=23920&dl=1 Third Party Advisory
http://packetstormsecurity.com/files/165643/Grandstream-GXV3175-Unauthenticated-Command-Execution.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/165931/Grandstream-GXV31XX-settimezone-Unauthenticated-Command-Execution.html Exploit,Third Party Advisory,VDB Entry
https://github.com/scarvell/grandstream_exploits Exploit,Third Party Advisory
https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=23920&dl=1 Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2019-10655, you might also want to check these: