Grandstream Gxp1628_firmware
7 CVEs affecting Grandstream Gxp1628_firmware. Latest disclosed: 2026-02-18. Critical: 3, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-2329 | Critical | 9.8 | 2026-02-18 | An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulne… |
CVE-2018-17565 | Critical | 9.8 | 2019-04-01 | Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute arbitrary system comm… |
CVE-2018-17564 | Critical | 9.8 | 2019-04-01 | A Malformed Input String to /cgi-bin/delete_CA on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to delete configuration parameters and gain admin… |
CVE-2020-5739 | High | 8.8 | 2020-04-14 | Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker adds an OpenVPN up script to t… |
CVE-2020-5738 | High | 8.8 | 2020-04-14 | Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker uploads a specially crafted ta… |
CVE-2025-28170 | High | 7.6 | 2025-07-29 | Grandstream Networks GXP1628 <=1.0.4.130 is vulnerable to Incorrect Access Control. The device is configured with directory listing enabled, allowing unauthori… |
CVE-2018-17563 | Medium | 5.3 | 2019-04-01 | A Malformed Input String to /cgi-bin/api-get_line_status on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to dump the device's configuration in cl… |