Skip to content
OpenAdvisories

Vendor

Grandstream

6 known vulnerabilities.

Grandstream at a glance

Last 12 months
2
Critical · all time
3
Exploited · all time
0
Public exploit · all time
3
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 1 vulnerability Dec 2025 January 2026: 0 vulnerabilities February 2026: 1 vulnerability, 1 critical March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202611
Jan 202600
Dec 202510
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

Grandstream GSD3710 2 GXP1625 2 UCM Series 1 GXP1610 1 GXP1615 1 GXP1620 1 GXP1628 1 GXP1630 1 GXP2135 1
All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • Critical 9.3
    CVE-2026-2329 Public exploit EPSS 42%

    Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflow

    An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote code execution (RCE) with root privileges on a target dev…

    Grandstream GXP1625 GXP1615 GXP1630
  • Low 3.5
    CVE-2025-14186

    Grandstream GXP1625 Network Status api.values.post cross site scripting

    A security flaw has been discovered in Grandstream GXP1625 1.0.7.4. The impacted element is an unknown function of the file /cgi-bin/api.values.post of the component Network Status Page. Performing manipulation of the argument vpn_ip results in basic cross si…

    Grandstream GXP1625
  • High 8.1
    CVE-2024-32937 EPSS 27%

    An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of Grandstream GXP2135 1.0.9…

    Grandstream GXP2135
  • High 8.8
    CVE-2024-0840

    Grandstream UCM Series IP PBX HTTP Parameter Injection

    The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP request. Authentication may …

    Grandstream UCM Series
  • Critical 9.8
    CVE-2022-2070 Public exploit

    Grandstream GSD3710 Stack-based Buffer Overflow

    In Grandstream GSD3710 in its 1.0.11.13 version, it's possible to overflow the stack since it doesn't check the param length before using the sscanf instruction. Because of that, an attacker could create a socket and connect with a remote IP:port by opening a…

    Grandstream Grandstream GSD3710
  • Critical 9.8
    CVE-2022-2025 Public exploit

    Grandstream GSD3710 Stack-based Buffer Overflow

    an attacker with knowledge of user/pass of Grandstream GSD3710 in its 1.0.11.13 version, could overflow the stack since it doesn't check the param length before use the strcopy instruction. The explotation of this vulnerability may lead an attacker to execute…

    Grandstream Grandstream GSD3710