CVEvulnerability
CVE-2016-1518
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2017-04-21
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.1 HIGH — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-284
Description
The auto-provisioning mechanism in the Grandstream Wave app 1.0.1.26 and earlier for Android and Grandstream Video IP phones allows man-in-the-middle attackers to spoof provisioning data and consequently modify device functionality, obtain sensitive information from system logs, and have unspecified other impact by leveraging failure to use an HTTPS session for downloading configuration files from http://fm.grandstream.com/gs/.
Affected configurations
• grandstream wave (<= 1.0.1.26)
Related
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
References
- http://packetstormsecurity.com/files/136280/Grandstream-Wave-1.0.1.26-Man-In-The-Middle.html Third Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/537818/100/0/threaded www.securityfocus.com
- https://rt-solutions.de/wp-content/uploads/2016/04/CVE-2016-1518-insecure-provisioning.pdf Third Party Advisory
- http://packetstormsecurity.com/files/136280/Grandstream-Wave-1.0.1.26-Man-In-The-Middle.html Third Party Advisory, VDB Entry
- http://www.securityfocus.com/archive/1/537818/100/0/threaded www.securityfocus.com
- https://rt-solutions.de/wp-content/uploads/2016/04/CVE-2016-1518-insecure-provisioning.pdf Third Party Advisory