CVE-2021-37915

An issue was discovered on the Grandstream HT801 Analog Telephone Adaptor before 1.0.29.8. From the limited configuration shell, it is possible to set the malicious gdb_debug_server variable. As a result, after a reboot, the device downloads and executes malicious scripts from an attacker-defined host.

• http://firmware.grandstream.com/BETA/Release_Note_HT80x_1.0.29.8.pdfBroken Link
• http://www.grandstream.com/products/gateways-and-atas/analog-telephone-adaptors/product/ht801Product, Vendor Advisory
• https://www.secforce.com/blog/exploiting-grandstream-ht801-ata-cve-2021-37748-cve-2021-37915/Exploit, Third Party Advisory
• http://firmware.grandstream.com/BETA/Release_Note_HT80x_1.0.29.8.pdfBroken Link
• http://www.grandstream.com/products/gateways-and-atas/analog-telephone-adaptors/product/ht801Product, Vendor Advisory
• https://www.secforce.com/blog/exploiting-grandstream-ht801-ata-cve-2021-37748-cve-2021-37915/Exploit, Third Party Advisory

Published

Oct 28, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-3791An information disclosure vulnerability was reported in some…6.5
• CVE-2021-37910ASUS routers Wi-Fi protected access protocol (WPA2 and WPA3-…5.3
• CVE-2021-37911The management interface of BenQ smart wireless conference p…8.8
• CVE-2021-37912The HGiga OAKlouds mobile portal does not filter special cha…9.8
• CVE-2021-37913The HGiga OAKlouds mobile portal does not filter special cha…9.8
• CVE-2021-37914In Argo Workflows through 3.1.3, if EXPRESSION_TEMPLATES is …6.5
• CVE-2021-37916Joplin before 2.0.9 allows XSS via button and form in the no…6.1
• CVE-2021-37918Zoho ManageEngine ADManager Plus version 7110 and prior allo…9.8
• CVE-2021-37919Zoho ManageEngine ADManager Plus version 7110 and prior allo…9.8
• CVE-2021-3792Some device communications in some Motorola-branded Binatone…5.3
• CVE-2021-37920Zoho ManageEngine ADManager Plus version 7110 and prior allo…9.8
• CVE-2021-37921Zoho ManageEngine ADManager Plus version 7110 and prior allo…9.8