Grandstream vulnerabilities
57 vulnerabilities
Known vulnerabilities in Grandstream products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 64 products.
Products
50 of 64- Ucm62049 vulnerabilities
- Gxp16257 vulnerabilities
- Gxp16287 vulnerabilities
- Ht8027 vulnerabilities
- Ucm62027 vulnerabilities
- Ucm62087 vulnerabilities
- Gxp16106 vulnerabilities
- Gxp16156 vulnerabilities
- Gxp16206 vulnerabilities
- Gxp16306 vulnerabilities
- Ht8016 vulnerabilities
- Ht8124 vulnerabilities
- Ht8134 vulnerabilities
- Ht8144 vulnerabilities
- Ht8184 vulnerabilities
- Gwn70003 vulnerabilities
- Gxv35003 vulnerabilities
- Gxv35013 vulnerabilities
- Gxv35043 vulnerabilities
- Gxv36013 vulnerabilities
- Gxv3615Wp Hd3 vulnerabilities
- Gxv3651Fhd3 vulnerabilities
- Gxv3662Hd3 vulnerabilities
- Wave3 vulnerabilities
- Gds37102 vulnerabilities
- Grandstream Gsd37102 vulnerabilities
- Grp26122 vulnerabilities
- Grp2612P2 vulnerabilities
- Grp2612W2 vulnerabilities
- Grp26132 vulnerabilities
- Grp26142 vulnerabilities
- Grp26152 vulnerabilities
- Grp26162 vulnerabilities
- Gwn76102 vulnerabilities
- Gxv Device2 vulnerabilities
- Gxv3601Hd\/Ll2 vulnerabilities
- Gxv3611Hd\/Ll2 vulnerabilities
- Gxv3611Ir Hd2 vulnerabilities
- Gxv3615W\/P2 vulnerabilities
- Ht4882 vulnerabilities
- Ucm65102 vulnerabilities
- Bt 1001 vulnerabilities
- Budgetone 1011 vulnerabilities
- Budgetone 1021 vulnerabilities
- Budgetone 2001 vulnerabilities
- Gac25001 vulnerabilities
- Gvc32021 vulnerabilities
- Gxp 20001 vulnerabilities
- Gxp21351 vulnerabilities
- Gxp22001 vulnerabilities
CVE-2018-17564grandstreamgxp1610_firmware+5
EPSS score1.58%
A Malformed Input String to /cgi-bin/delete_CA on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to delete configuration parameters and gain admin access to the device.CVE-2018-17565grandstreamgxp1610_firmware+5EPSS score1.93%
Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute arbitrary system commands and gain a root shell.CVE-2018-17563grandstreamgxp1610_firmware+5EPSS score0.70%
A Malformed Input String to /cgi-bin/api-get_line_status on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to dump the device's configuration in cleartext.CVE-2013-3963grandstreamgxv_device_firmware+10EPSS score0.92%
Cross-site request forgery (CSRF) vulnerability in goform/usermanage in Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP_HD, GXV3500, and possibly other camera models allows remote attackers to hijack the authentication of unspecified victims for requests that add users.CVE-2013-3542grandstreamgxv3500+12EPSS score2.60%
Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP_HD, GXV3500, and possibly other camera models with firmware 1.0.4.11, have a hardcoded account "!#/" with the same password, which makes it easier for remote attackers to obtain access via a TELNET session.CVE-2013-3962grandstreamgxv_device_firmware+10EPSS score0.93%
Cross-site scripting (XSS) vulnerability in Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP_HD, GXV3500, and possibly other camera models before firmware 1.0.4.44, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.CVE-2021-37748grandstreamht801_firmwareEPSS score7.41%
Multiple buffer overflows in the limited configuration shell (/sbin/gs_config) on Grandstream HT801 devices before 1.0.29 allow remote authenticated users to execute arbitrary code as root via a crafted manage_if setting, thus bypassing the intended restrictions of this shell and taking full control of the device. There are default weak credentials that can be used to authenticate.CVE-2021-37915grandstreamht801_firmwareEPSS score2.03%
An issue was discovered on the Grandstream HT801 Analog Telephone Adaptor before 1.0.29.8. From the limited configuration shell, it is possible to set the malicious gdb_debug_server variable. As a result, after a reboot, the device downloads and executes malicious scripts from an attacker-defined host.CVE-2015-2866grandstreamgxv3611_hd_firmwareEPSS score1.53%
SQL injection vulnerability on the Grandstream GXV3611_HD camera with firmware before 1.0.3.9 beta allows remote attackers to execute arbitrary SQL commands by attempting to establish a TELNET session with a crafted username.CVE-2007-1590grandstreambudgetone_200EPSS score4.08%
The Grandstream BudgeTone 200 IP phone, with program 1.1.1.14 and bootloader 1.1.1.5, allows remote attackers to cause a denial of service (device crash) via SIP (1) INVITE, (2) CANCEL, or unspecified other messages with a WWW-Authenticate header containing a crafted Digest domain.CVE-2007-4498grandstreamsip_phoneEPSS score13.75%
The Grandstream SIP Phone GXV-3000 with firmware 1.0.1.7, Loader 1.0.0.6, and Boot 1.0.0.18 allows remote attackers to force silent call completion, eavesdrop on the phone's local environment, and cause a denial of service (blocked call reception) via a certain SIP INVITE message followed by a certain "SIP/2.0 183 Session Progress" message.CVE-2007-5789grandstreamht488EPSS score1.67%
The Grandstream HT-488 0.1 allows remote attackers to cause a denial of service (device crash) via a flood of fragmented packets to port 5060.CVE-2007-5788grandstreamht488EPSS score1.53%
Buffer overflow in the SIP parser on the Grandstream HT-488 0.1 allows remote attackers to cause a denial of service (device crash) via a crafted SIP INVITE message.CVE-2016-1520grandstreamwaveEPSS score2.16%
The Grandstream Wave app 1.0.1.26 and earlier for Android does not use HTTPS when retrieving update information, which might allow man-in-the-middle attackers to execute arbitrary code via a crafted application.CVE-2016-1518grandstreamwaveEPSS score1.72%
The auto-provisioning mechanism in the Grandstream Wave app 1.0.1.26 and earlier for Android and Grandstream Video IP phones allows man-in-the-middle attackers to spoof provisioning data and consequently modify device functionality, obtain sensitive information from system logs, and have unspecified other impact by leveraging failure to use an HTTPS session for downloading configuration files from http://fm.grandstream.com/gs/.CVE-2016-1519grandstreamwaveEPSS score0.96%
The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validate SSL certificates, which allows man-in-the-middle attackers to spoof the Grandstream provisioning server via a crafted certificate.CVE-2025-14186grandstreamgxp1625_firmwareEPSS score0.23%
A security flaw has been discovered in Grandstream GXP1625 1.0.7.4. The impacted element is an unknown function of the file /cgi-bin/api.values.post of the component Network Status Page. Performing manipulation of the argument vpn_ip results in basic cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.CVE-2025-28171grandstreamucm6510_firmwareEPSS score0.33%
An issue in Grandstream UCM6510 v.1.0.20.52 and before allows a remote attacker to obtain sensitive information via the Login function at /cgi and /webrtccgi.CVE-2025-28172grandstreamucm6510_firmwareEPSS score0.29%
Grandstream Networks UCM6510 v1.0.20.52 and before is vulnerable to Improper Restriction of Excessive Authentication Attempts. An attacker can perform an arbitrary number of authentication attempts using different passwords and eventually gain access to the targeted account using a brute force attack.CVE-2025-28170grandstreamgxp1628_firmwareEPSS score0.33%
Grandstream Networks GXP1628 <=1.0.4.130 is vulnerable to Incorrect Access Control. The device is configured with directory listing enabled, allowing unauthorized access to sensitive directories and files.