Grandstream

22 CVEs across 115 Grandstream products. Browse Grandstream vulnerabilities, severities, and proof-of-concept exploits.

Grandstream products with known CVEs

ProductCVEs
Ucm62049
Ucm6204 Firmware9
Gxp16257
Gxp16287
Gxp1628 Firmware7
Ht8027
Ht802 Firmware7
Ucm62027
Ucm6202 Firmware7
Ucm62087
Ucm6208 Firmware7
Gxp16106
Gxp1610 Firmware6
Gxp16156
Gxp1615 Firmware6
Gxp16206
Gxp1620 Firmware6
Gxp1625 Firmware6
Gxp16306
Gxp1630 Firmware6
Ht8016
Ht801 Firmware6
Ht8124
Ht812 Firmware4
Ht8134
Ht813 Firmware4
Ht8144
Ht814 Firmware4
Ht8184
Ht818 Firmware4
Gwn70003
Gwn7000 Firmware3
Gxv35003
Gxv35013
Gxv35043
Gxv36013
Gxv3615wp Hd3
Gxv3651fhd3
Gxv3662hd3
Wave3
Gds37102
Gds3710 Firmware2
Grandstream Gsd37102
Grp26122
Grp2612 Firmware2
Grp2612p2
Grp2612p Firmware2
Grp2612w2
Grp2612w Firmware2
Grp26132
Grandstream CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-2329Critical9.82026-02-18An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulne…
CVE-2025-14186Low3.52025-12-07A security flaw has been discovered in Grandstream GXP1625 1.0.7.4. The impacted element is an unknown function of the file /cgi-bin/api.values.post of the com…
CVE-2025-28170High7.62025-07-29Grandstream Networks GXP1628 <=1.0.4.130 is vulnerable to Incorrect Access Control. The device is configured with directory listing enabled, allowing unauthori…
CVE-2025-28171Medium6.52025-07-29An issue in Grandstream UCM6510 v.1.0.20.52 and before allows a remote attacker to obtain sensitive information via the Login function at /cgi and /webrtccgi.
CVE-2025-28172Medium6.52025-07-29Grandstream Networks UCM6510 v1.0.20.52 and before is vulnerable to Improper Restriction of Excessive Authentication Attempts. An attacker can perform an arbit…
CVE-2024-32937High8.12024-07-03An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of Grandstream GXP2135 1.0.9.129, 1.0.11.74 and 1.0.11.79. A special…
CVE-2024-0840High8.82024-04-29The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and auth…
CVE-2022-2070Critical9.82022-09-23In Grandstream GSD3710 in its 1.0.11.13 version, it's possible to overflow the stack since it doesn't check the param length before using the sscanf instructio…
CVE-2022-2025Critical9.82022-09-23an attacker with knowledge of user/pass of Grandstream GSD3710 in its 1.0.11.13 version, could overflow the stack since it doesn't check the param length befor…
CVE-2021-37915High8.82021-10-28An issue was discovered on the Grandstream HT801 Analog Telephone Adaptor before 1.0.29.8. From the limited configuration shell, it is possible to set the mali…
CVE-2021-37748High8.82021-10-28Multiple buffer overflows in the limited configuration shell (/sbin/gs_config) on Grandstream HT801 devices before 1.0.29 allow remote authenticated users to e…
CVE-2020-25218Critical9.82021-03-29Grandstream GRP261x VoIP phone running firmware version 1.0.3.6 (Base) allow Authentication Bypass in its administrative web interface.
CVE-2020-25217High7.22021-03-29Grandstream GRP261x VoIP phone running firmware version 1.0.3.6 (Base) allows Command Injection as root in its administrative web interface.
CVE-2020-5763High8.82020-07-29Grandstream HT800 series firmware version 1.0.17.5 and below contain a backdoor in the SSH service. An authenticated remote attacker can obtain a root shell by…
CVE-2020-5762High7.52020-07-29Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to a denial of service attack against the TR-069 service. An unauthenticated remote…
CVE-2020-5761High7.52020-07-29Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to CPU exhaustion due to an infinite loop in the TR-069 service. Unauthenticated rem…
CVE-2020-5760High7.82020-07-29Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to an OS command injection vulnerability. Unauthenticated remote attackers can execu…
CVE-2020-5759Critical9.82020-07-17Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via SSH. An authenticated remote attacker can execute com…
CVE-2020-5758High8.82020-07-17Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. An authenticated remote attacker can execute co…
CVE-2020-5757Critical9.82020-07-17Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. An authenticated remote attacker can bypass com…
CVE-2020-5756High8.82020-07-17Grandstream GWN7000 firmware version 1.0.9.4 and below allows authenticated remote users to modify the system's crontab via undocumented API. An attacker can u…
CVE-2020-5739High8.82020-04-14Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker adds an OpenVPN up script to t…
CVE-2020-5738High8.82020-04-14Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker uploads a specially crafted ta…
CVE-2020-5726High7.52020-03-30The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888. A remote unauthenticated attacker can invoke…
CVE-2020-5725Medium5.92020-03-30The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint. A remote unauthenticated attacker…
CVE-2020-5724High7.52020-03-30The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint. A remote unauthenticated attacker…
CVE-2020-5723Critical9.82020-03-30The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database. This could allow an attacker to retrieve all passwords and poss…
CVE-2020-5722Critical9.82020-03-23The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use thi…
CVE-2013-3542Critical10.02019-12-11Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP_HD, GXV3500, and possibly other camera models w…
CVE-2018-17565Critical9.82019-04-01Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute arbitrary system comm…
CVE-2018-17564Critical9.82019-04-01A Malformed Input String to /cgi-bin/delete_CA on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to delete configuration parameters and gain admin…
CVE-2018-17563Medium5.32019-04-01A Malformed Input String to /cgi-bin/api-get_line_status on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to dump the device's configuration in cl…
CVE-2019-10663High8.82019-03-30Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to conduct SQL injection attacks via the sord parameter in a listCodeblueGroup AP…
CVE-2019-10662High8.82019-03-30Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the backupUCMConfig file-ba…
CVE-2019-10661Critical9.82019-03-30On Grandstream GXV3611IR_HD before 1.0.3.23 devices, the root account lacks a password.
CVE-2019-10660High8.82019-03-30Grandstream GXV3611IR_HD before 1.0.3.23 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the /goform/systemlog?c…
CVE-2019-10659High8.82019-03-30Grandstream GXV3370 before 1.0.1.41 and WP820 before 1.0.3.6 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in a /…
CVE-2019-10658High8.82019-03-30Grandstream GWN7610 before 1.0.8.18 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the filename in a /ubus/cont…
CVE-2019-10657Medium6.52019-03-30Grandstream GWN7000 before 1.0.6.32 and GWN7610 before 1.0.8.18 devices allow remote authenticated users to discover passwords via a /ubus/uci.apply config req…
CVE-2019-10656High8.82019-03-30Grandstream GWN7000 before 1.0.6.32 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the filename in a /ubus/uci…
CVE-2019-10655Critical9.82019-03-30Grandstream GAC2500 1.0.3.35, GXP2200 1.0.3.27, GVC3202 1.0.3.51, GXV3275 before 1.0.3.219 Beta, and GXV3240 before 1.0.3.219 Beta devices allow unauthenticate…
CVE-2017-16565High8.82017-11-06Cross-Site Request Forgery (CSRF) in /cgi-bin/login on Vonage (Grandstream) HT802 devices allows attackers to authenticate a user via the login screen using th…
CVE-2017-16564Medium5.42017-11-06Stored Cross-site scripting (XSS) vulnerability in /cgi-bin/config2 on Vonage (Grandstream) HT802 devices allows remote authenticated users to inject arbitrary…
CVE-2017-16563High8.02017-11-06Cross-Site Request Forgery (CSRF) in the Basic Settings screen on Vonage (Grandstream) HT802 devices allows attackers to modify settings, related to cgi-bin/up…
CVE-2016-1520High7.82017-04-21The Grandstream Wave app 1.0.1.26 and earlier for Android does not use HTTPS when retrieving update information, which might allow man-in-the-middle attackers…
CVE-2016-1519Medium5.92017-04-21The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validate SSL certificates, which allows man-in-…
CVE-2016-1518High8.12017-04-21The auto-provisioning mechanism in the Grandstream Wave app 1.0.1.26 and earlier for Android and Grandstream Video IP phones allows man-in-the-middle attackers…
CVE-2015-28662015-07-08SQL injection vulnerability on the Grandstream GXV3611_HD camera with firmware before 1.0.3.9 beta allows remote attackers to execute arbitrary SQL commands by…
CVE-2013-39632013-10-01Cross-site request forgery (CSRF) vulnerability in goform/usermanage in Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651F…
CVE-2013-39622013-10-01Cross-site scripting (XSS) vulnerability in Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP_HD…
CVE-2007-57892007-11-01The Grandstream HT-488 0.1 allows remote attackers to cause a denial of service (device crash) via a flood of fragmented packets to port 5060.
CVE-2007-57882007-11-01Buffer overflow in the SIP parser on the Grandstream HT-488 0.1 allows remote attackers to cause a denial of service (device crash) via a crafted SIP INVITE me…
CVE-2007-44982007-08-23The Grandstream SIP Phone GXV-3000 with firmware 1.0.1.7, Loader 1.0.0.6, and Boot 1.0.0.18 allows remote attackers to force silent call completion, eavesdrop…
CVE-2007-15902007-03-21The Grandstream BudgeTone 200 IP phone, with program 1.1.1.14 and bootloader 1.1.1.5, allows remote attackers to cause a denial of service (device crash) via S…
CVE-2006-52312006-10-11Grandstream GXP-2000 VoIP Desktop Phone, firmware version 1.1.0.5, allows remote attackers to cause a denial of service (hang or reboot) via a large amount of…
CVE-2005-25812005-08-16Grandstream BudgeTone 101 and 102 running firmware 1.0.6.7 and possibly earlier versions, allows remote attackers to cause a denial of service (device hang or…
CVE-2005-2182High7.52005-07-11Grandstream BudgeTone (BT) 100 Voice over IP (VoIP) phones do not properly check the Call-ID, branch, and tag values in a NOTIFY message to verify a subscripti…