CVE-2022-2025

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

an attacker with knowledge of user/pass of Grandstream GSD3710 in its 1.0.11.13 version, could overflow the stack since it doesn't check the param length before use the strcopy instruction. The explotation of this vulnerability may lead an attacker to execute a shell with full access.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Sep 23, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-202507.8In Messaging, there is a possible way to attach files to a message without proper access checks due to improper input validation. This couldCVE-2022-202513.3In LocaleManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel informatiCVE-2022-202523.3In PackageManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel informatCVE-2022-202536.5In Bluetooth, there is a possible cleanup failure due to an uncaught exception. This could lead to remote denial of service in Bluetooth witCVE-2022-202548.8In Wi-Fi, there is a permissions bypass. This could lead to local escalation of privilege from the guest user with no additional execution pCVE-2022-202554.4In SettingsProvider, there is a possible way to read or change the default ringtone due to a missing permission check. This could lead to loCVE-2022-202566.4In the Audio HAL, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with SysCVE-2022-202573.3In Bluetooth, there is a possible way to pair a display only device without PIN confirmation due to a logic error in the code. This could leCVE-2022-202587.8In Bluetooth, there is a possible way to bypass compiler exploit mitigations due to a configuration error. This could lead to local escalatiCVE-2022-202595.5In Telephony, there is a possible leak of ICCID and EID due to a missing permission check. This could lead to local information disclosure wCVE-2022-20265.4Cross-site Scripting (XSS) - Stored in GitHub repository kromitgmbh/titra prior to 0.77.0.CVE-2022-202605.5In the Phone app, there is a possible crash loop due to resource exhaustion. This could lead to local persistent denial of service in the Ph