Secunia

Pierre Kroma has reported a vulnerability in Grandstream BudgeTone 100 Series SIP Phones, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an error when processing large UDP datagrams and can be exploited by sending a large UDP datagram (more than 65534 bytes) to port 5060/udp.

Successful exploitation causes the phone to stop working by aborting active calls, blank the display, and make the integrated HTTP server become inaccessible.

The vulnerability has been reported in firmware release 1.0.6.7. Other versions may also be affected.

Solution
Use the phones on trusted networks only.

Provided and/or discovered by
Pierre Kroma, SySS.

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area