CVE-2020-25218
Critical
Description
Grandstream GRP261x VoIP phone running firmware version 1.0.3.6 (Base) allow Authentication Bypass in its administrative web interface.
SeverityCritical
CVSS9.8
Exploit probability—
ProductGrandstream Grp2612 Firmware
PublishedMar 29, 2021
First seenMar 29, 2021
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| grandstream grp2612_firmware | 1.0.3.6 | — |
| grandstream grp2612p_firmware | 1.0.3.6 | — |
| grandstream grp2612w_firmware | 1.0.3.6 | — |
| grandstream grp2613_firmware | 1.0.3.6 | — |
| grandstream grp2614_firmware | 1.0.3.6 | — |
| grandstream grp2615_firmware | 1.0.3.6 | — |
| grandstream grp2616_firmware | 1.0.3.6 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.