CVE-2021-37915 is a high-severity vulnerability affecting Grandstream HT801 Analog Telephone Adaptors before firmware version 1.0.29.8. An authenticated attacker with limited configuration shell access can set a malicious gdb_debug_server variable, leading to the device downloading and executing arbitrary scripts from an attacker-controlled host after a reboot. With a CVSS score of 8.8 (HIGH), this vulnerability allows for complete compromise of confidentiality, integrity, and availability. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), community discussion indicates awareness of its exploitability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.0.29.8CPE matchmatch criteria | cpe:2.3:o:grandstream:ht801_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.