Grandstream Wave vulnerabilities

3 CVEs affecting Grandstream Wave, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-1520, published 2017-04-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-1520, published 2017-04-21. High severity, CVSS 7.8. EPSS: 2.2% chance of exploitation in the next 30 days. The Grandstream Wave app 1.0.1.26 and earlier for Android does not use HTTPS when retrieving update information, which might allow man-in-the-middle attackers to execute arbitrary code via a crafted…
CVE-2016-1518, published 2017-04-21. High severity, CVSS 8.1. EPSS: 1.7% chance of exploitation in the next 30 days. The auto-provisioning mechanism in the Grandstream Wave app 1.0.1.26 and earlier for Android and Grandstream Video IP phones allows man-in-the-middle attackers to spoof provisioning data and…
CVE-2016-1519, published 2017-04-21. Medium severity, CVSS 5.9. EPSS: 1% chance of exploitation in the next 30 days. The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validate SSL certificates, which allows man-in-the-middle attackers to spoof the…