What is CVE-2020-5756?

CVE-2020-5756 is a high-severity vulnerability in Grandstream Gwn7000, classified under Active Debug Code. CVSS score: 8.8/10. Published 2020-07-17.

How severe is CVE-2020-5756?

High severity. CVSS v3 base score is 8.8 out of 10.

RCE in Grandstream Gwn7000

CVE-2020-5756

Grandstream GWN7000 firmware version 1.0.9.4 and below allows authenticated remote users to modify the system's crontab via undocumented API. An attacker can use this functionality to execute arbitrary OS commands on the router.

EPSS: 0.025 (82.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Grandstream Gwn7000
Grandstream Gwn7000_firmware
Tenable Grandstream Gwn7000 — versions Versions 1.0.9.4 and below

Weakness classification (CWE)

References

vulnreport@tenable.com (x_refsource_CONFIRM, Not Applicable)
nvd@nist.gov (Exploit, Third Party Advisory)

Frequently asked questions

What is CVE-2020-5756?: CVE-2020-5756 is a high-severity vulnerability in Grandstream Gwn7000, classified under Active Debug Code. CVSS score: 8.8/10. Published 2020-07-17.
How severe is CVE-2020-5756?: High severity. CVSS v3 base score is 8.8 out of 10.