Rapid7 Vulnerability & Exploit Database

Grandstream GXV31XX 'settimezone' Unauthenticated Command Execution

Back to Search

Grandstream GXV31XX 'settimezone' Unauthenticated Command Execution

Disclosed
09/01/2016
Created
02/09/2022

Description

This module exploits a command injection vulnerability in Grandstream GXV31XX IP multimedia phones. The 'settimezone' action does not validate input in the 'timezone' parameter allowing injection of arbitrary commands. A buffer overflow in the 'phonecookie' cookie parsing allows authentication to be bypassed by providing an alphanumeric cookie 93 characters in length. This module was tested successfully on Grandstream models: GXV3175v2 hardware revision V2.6A with firmware version 1.0.1.19; and GXV3140 hardware revision V0.4B with firmware version 1.0.1.27.

Author(s)

  • alhazred
  • Brendan Scarvell
  • bcoles <bcoles@gmail.com>

Platform

Linux,Unix

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/linux/http/grandstream_gxv31xx_settimezone_unauth_cmd_exec
msf exploit(grandstream_gxv31xx_settimezone_unauth_cmd_exec) > show targets
    ...targets...
msf exploit(grandstream_gxv31xx_settimezone_unauth_cmd_exec) > set TARGET < target-id >
msf exploit(grandstream_gxv31xx_settimezone_unauth_cmd_exec) > show options
    ...show and set options...
msf exploit(grandstream_gxv31xx_settimezone_unauth_cmd_exec) > exploit

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;