CVE:CVE-2019-10655
CNNVD:CNNVD-201903-1220
Grandstream GAC2500等都是美国潮流网络（Grandstream）公司的产品。Grandstream GAC2500是一款基于Android平台的商务会议电话设备。Grandstream GXP2200是一款IP电话。Grandstream GVC3202是一款全高清视频会议设备。
多款Grandstream产品中存在操作系统命令注入漏洞。该漏洞源于网络系统或产品在内存上执行操作时，未正确验证数据边界，导致向关联的其他内存位置上执行了错误的读写操作。攻击者可利用该漏洞导致缓冲区溢出或堆溢出等。以下产品及版本受到影响：Grandstream GAC2500 1.0.3.35版本；GXP2200 1.0.3.27版本；GVC3202 1.0.3.51版本；GXV3275 1.0.3.219 Beta之前版本；GXV3240 1.0.3.219 Beta之前版本。
solution:Upgrade grandstream gac2500_firmware to a higher version than 1.0.3.35,and avoid the version (,1.0.3.35]; Upgrade grandstream gvc3202_firmware to a higher version than 1.0.3.51,and avoid the version (,1.0.3.51); Upgrade grandstream gxv3275_firmware to a higher version than 1.0.3.219,and avoid the version (,1.0.3.219); Upgrade grandstream gxv3240_firmware to a higher version than 1.0.3.219,and avoid the version (,1.0.3.219); Upgrade grandstream gxp2200_firmware to a higher version than 1.0.3.27,and avoid the version (,1.0.3.27]