CVE-2016-1520 The Grandstream Wave app 1.0.1.26 and earlier for Android does not use HTTPS when retrieving update information, which might allow man-in-the-middle attackers to execute arbitrary code via a crafted a...
HighCVSS 7.8
EPSS 2.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Grandstream Wave app 1.0.1.26 and earlier for Android does not use HTTPS when retrieving update information, which might allow man-in-the-middle attackers to execute arbitrary code via a crafted application.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| grandstream wave | <= 1.0.1.26 | No fix listed |
References
- packetstormsecurity.com third-party-advisory vdb-entry
- 20160317 CVE-2016-1520: GrandStream Android VoIP App Update Redirection mailing-list
- rt-solutions.de third-party-advisory