CVE-2020-5739
Estado: ModificadaAlta (8.8)—
Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker adds an OpenVPN up script to the phone's VPN settings via the "Additional Settings" field in the web interface. When the VPN's connection is established, the user defined script is executed with root privileges.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 8.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 5.34%
- Percentil entre todas las CVEs puntuadas: 92
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (6)
CWE
- CWE-94
- CWE-94
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2020-5739",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 9,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"authentication": "SINGLE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.8,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "vulnreport@tenable.com",
"affectedData": [
{
"vendor": "n/a",
"product": "Grandstream GXP1600 Series",
"versions": [
{
"status": "affected",
"version": "1.0.4.152 and below"
}
]
}
]
}
],
"published": "2020-04-14T14:15:12.007",
"references": [
{
"url": "https://www.tenable.com/security/research/tra-2020-22",
"tags": [
"Exploit",
"Vendor Advisory"
],
"source": "vulnreport@tenable.com"
},
{
"url": "https://www.tenable.com/security/research/tra-2020-22",
"tags": [
"Exploit",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "vulnreport@tenable.com",
"description": [
{
"lang": "en",
"value": "CWE-94"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-94"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker adds an OpenVPN up script to the phone's VPN settings via the \"Additional Settings\" field in the web interface. When the VPN's connection is established, the user defined script is executed with root privileges."
},
{
"lang": "es",
"value": "La serie Grandstream GXP1600 versión de firmware 1.0.4.152 y posteriores, es vulnerable a una ejecución de comandos remota autenticada cuando un atacante agrega un script de OpenVPN a la configuración de VPN del teléfono por medio del campo \"Additional Settings\" en la interfaz web. Cuando la conexión de VPN es establecida, el script definido por el usuario es ejecutado con privilegios root."
}
],
"lastModified": "2026-06-17T03:22:08.937",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:grandstream:gxp1610_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "718E23DE-61E2-47CE-894B-E3B4EFCB761E",
"versionEndIncluding": "1.0.4.152"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:grandstream:gxp1610:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D92122D2-AD92-4EC3-81C3-CC58C3E3C287"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:grandstream:gxp1615_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0285B11D-A50B-4650-ADDE-DC1D140AB894",
"versionEndIncluding": "1.0.4.152"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:grandstream:gxp1615:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "713E836B-E61E-4E74-9026-F6470C9555F1"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:grandstream:gxp1620_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "12FDA102-F6D4-4F67-A07C-9919FA23BB6E",
"versionEndIncluding": "1.0.4.152"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:grandstream:gxp1620:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "898FC5BB-6D88-4ED3-95FE-ACFA8D99AAD7"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:grandstream:gxp1625_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "427357FB-9EEE-43D8-B683-9BD412A68FC7",
"versionEndIncluding": "1.0.4.152"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:grandstream:gxp1625:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "280FCCEF-196B-4BD4-B5C2-7DECC224A84C"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:grandstream:gxp1628_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2C15DDAE-9E8F-4BCB-8650-E70374A2A33F",
"versionEndIncluding": "1.0.4.152"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:grandstream:gxp1628:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8CDF28C0-982E-4DB8-8F3A-75103F2AF9A4"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:grandstream:gxp1630_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D23F0025-3B02-43BD-8778-C91B40424DB1",
"versionEndIncluding": "1.0.4.152"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:grandstream:gxp1630:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "63FC9463-51FD-493D-B2FD-4E61EC6B98CA"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "vulnreport@tenable.com"
}