CVE-2016-1520

CVE-2016-1520 describes a vulnerability in Grandstream Wave app versions 1.0.1.26 and earlier for Android, where the application fails to use HTTPS for update information retrieval. This oversight creates an opportunity for man-in-the-middle attackers to inject and execute arbitrary code through a crafted application. Rated with a CVSS score of 7.8 (High), the vulnerability has a local attack vector, low attack complexity, and high impacts on confidentiality, integrity, and availability, requiring user interaction. Despite its severity, there is no evidence of active exploitation, no known public exploit code (Metasploit, Nuclei, ExploitDB), and minimal community discussion or media coverage.