Sign-up

ID

VAR-201507-0148


CVE

CVE-2015-2866


TITLE

Grandstream GXV3611_HD Camera SQL Injection Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2015-04400 // CNNVD: CNNVD-201507-191

DESCRIPTION

SQL injection vulnerability on the Grandstream GXV3611_HD camera with firmware before 1.0.3.9 beta allows remote attackers to execute arbitrary SQL commands by attempting to establish a TELNET session with a crafted username. Grandstream GXV3611_HD Is a network camera for surveillance. Grandstream GXV3611_HD Is SQL There is an injection vulnerability. An attacker can use this vulnerability to SQL It is possible to perform injection attacks. CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') http://cwe.mitre.org/data/definitions/89.htmlBy a remote third party SQL By injection, the settings of the device may be viewed or changed. Grandstream GXV3611_HD is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Grandstream GXV3611_HD 1.0.3.6 is vulnerable

Trust: 3.24

sources: NVD: CVE-2015-2866 // CERT/CC: VU#253708 // JVNDB: JVNDB-2015-003477 // CNVD: CNVD-2015-04400 // BID: 75580 // VULHUB: VHN-80827

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

category:['camera device']sub_category:camera

Trust: 0.1

sources: OTHER: None // CNVD: CNVD-2015-04400

AFFECTED PRODUCTS

vendor:grandstreammodel:gxv3611 hdscope:lteversion:1.0.3.6

Trust: 1.0

vendor:grandstreammodel:gxv3611 hdscope:eqversion:1.0.3.6

Trust: 0.9

vendor:grandstreammodel: - scope: - version: -

Trust: 0.8

vendor:grandstreammodel:gxv3611 hdscope: - version: -

Trust: 0.8

vendor:grandstreammodel:gxv3611 hdscope:lteversion:version 1.0.3.6

Trust: 0.8

vendor:grandstreammodel:gxv3611 hd betascope:ltversion:1.0.3.9

Trust: 0.6

vendor:grandstreammodel:gxv3611 hd betascope:neversion:1.0.3.9

Trust: 0.3

sources: CERT/CC: VU#253708 // CNVD: CNVD-2015-04400 // BID: 75580 // JVNDB: JVNDB-2015-003477 // CNNVD: CNNVD-201507-191 // NVD: CVE-2015-2866

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-2866
value: HIGH

Trust: 1.0

NVD: CVE-2015-2866
value: MEDIUM

Trust: 0.8

NVD: CVE-2015-2866
value: HIGH

Trust: 0.8

CNVD: CNVD-2015-04400
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201507-191
value: HIGH

Trust: 0.6

VULHUB: VHN-80827
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2015-2866
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

NVD: CVE-2015-2866
severity: MEDIUM
baseScore: 6.4
vectorString: NONE
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2015-04400
severity: MEDIUM
baseScore: 6.4
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-80827
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CERT/CC: VU#253708 // CNVD: CNVD-2015-04400 // VULHUB: VHN-80827 // JVNDB: JVNDB-2015-003477 // CNNVD: CNNVD-201507-191 // NVD: CVE-2015-2866

PROBLEMTYPE DATA

problemtype:CWE-89

Trust: 1.9

sources: VULHUB: VHN-80827 // JVNDB: JVNDB-2015-003477 // NVD: CVE-2015-2866

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201507-191

TYPE

SQL injection

Trust: 0.6

sources: CNNVD: CNNVD-201507-191

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-003477

EXPLOIT AVAILABILITY
sources:
            
            
            CERT/CC: VU#253708 // 
            
            
            
            VULHUB: VHN-80827

PATCH
title:Patch for the Grandstream GXV3611_HD Camera SQL Injection Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/60767
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2015-04400

EXTERNAL IDS
db:CERT/CCid:VU#253708
Trust: 4.2
db:NVDid:CVE-2015-2866
Trust: 3.5
db:EXPLOIT-DBid:40441
Trust: 1.1
db:JVNid:JVNVU97426101
Trust: 0.8
db:JVNDBid:JVNDB-2015-003477
Trust: 0.8
db:CNNVDid:CNNVD-201507-191
Trust: 0.7
db:CNVDid:CNVD-2015-04400
Trust: 0.6
db:BIDid:75580
Trust: 0.4
db:OTHERid:NONE
Trust: 0.1
db:VULHUBid:VHN-80827
Trust: 0.1
sources:
            
            
            OTHER: None // 
            
            
            
            CERT/CC: VU#253708 // 
            
            
            
            CNVD: CNVD-2015-04400 // 
            
            
            
            VULHUB: VHN-80827 // 
            
            
            
            BID: 75580 // 
            
            
            
            JVNDB: JVNDB-2015-003477 // 
            
            
            
            CNNVD: CNNVD-201507-191 // 
            
            
            
            NVD: CVE-2015-2866

REFERENCES
url:http://www.kb.cert.org/vuls/id/253708
Trust: 3.4
url:https://www.exploit-db.com/exploits/40441/
Trust: 1.1
url:about vulnerability notes
Trust: 0.8
url:contact us about this vulnerability
Trust: 0.8
url:provide a vendor statement
Trust: 0.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-2866
Trust: 0.8
url:http://jvn.jp/vu/jvnvu97426101
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-2866
Trust: 0.8
url:http://www.grandstream.com/
Trust: 0.3
url:https://ieeexplore.ieee.org/abstract/document/10769424
Trust: 0.1
sources:
            
            
            OTHER: None // 
            
            
            
            CERT/CC: VU#253708 // 
            
            
            
            CNVD: CNVD-2015-04400 // 
            
            
            
            VULHUB: VHN-80827 // 
            
            
            
            BID: 75580 // 
            
            
            
            JVNDB: JVNDB-2015-003477 // 
            
            
            
            CNNVD: CNNVD-201507-191 // 
            
            
            
            NVD: CVE-2015-2866

CREDITS
Living Lab at IUPUI
Trust: 0.3
sources:
            
            
            BID: 75580

SOURCES
db:OTHERid: - 
db:CERT/CCid:VU#253708
db:CNVDid:CNVD-2015-04400
db:VULHUBid:VHN-80827
db:BIDid:75580
db:JVNDBid:JVNDB-2015-003477
db:CNNVDid:CNNVD-201507-191
db:NVDid:CVE-2015-2866

LAST UPDATE DATE
2025-04-12T22:50:10.596000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#253708date:2015-07-07T00:00:00
db:CNVDid:CNVD-2015-04400date:2015-07-13T00:00:00
db:VULHUBid:VHN-80827date:2017-09-03T00:00:00
db:BIDid:75580date:2015-07-07T00:00:00
db:JVNDBid:JVNDB-2015-003477date:2015-07-10T00:00:00
db:CNNVDid:CNNVD-201507-191date:2015-07-09T00:00:00
db:NVDid:CVE-2015-2866date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:CERT/CCid:VU#253708date:2015-07-07T00:00:00
db:CNVDid:CNVD-2015-04400date:2015-07-13T00:00:00
db:VULHUBid:VHN-80827date:2015-07-08T00:00:00
db:BIDid:75580date:2015-07-07T00:00:00
db:JVNDBid:JVNDB-2015-003477date:2015-07-10T00:00:00
db:CNNVDid:CNNVD-201507-191date:2015-07-09T00:00:00
db:NVDid:CVE-2015-2866date:2015-07-08T14:59:00.080