grandstream-grp-default-login: Grandstream GRP - Default Login

id: grandstream-grp-default-login

info:
  name: Grandstream GRP - Default Login
  author: DhiyaneshDK
  severity: high
  description: |
    Grandstream GRP series devices use default credentials (admin/admin). The web UI login sends a SHA-256 hash of the password to /cgi-bin/access. Successful authentication returns a JSON response with a session token, indicating full admin access to the device management interface.
  remediation: |
    Change the default administrator password immediately. Update firmware to the latest version which generates random passwords on factory reset.
  metadata:
    verified: true
    max-request: 1
    vendor: grandstream
    shodan-query: tl.account.ucm.js
  tags: default-login,grandstream,grp,iot,vuln

http:
  - raw:
      - |
        POST /cgi-bin/access HTTP/1.1
        Host: {{Hostname}}
        X-Requested-With: XMLHttpRequest
        Accept: application/json, text/plain, */*
        Content-Type: application/x-www-form-urlencoded
        Origin: {{RootURL}}
        Referer: {{RootURL}}

        access={{sha256("admin")}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"response":"success"'
          - '"body":'
        condition: and

      - type: status
        status:
          - 200
# digest: 490a0046304402203648e803bc2f1e65b0498364439e4e51094c2a09378c3078782e56f10e2159d002202dd2cf94f3372e4067165ff062a42548b7acc7fc6c41663477b2af9a9f97de73:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.