Grandstream vulnerabilities
We track 8 vulnerabilities in Grandstream products across 24 products. 8 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on February 18, 2026.
Latest Grandstream vulnerabilities
- 9.8 Critical severity
GXP1610: Stack-based Buffer Overflow
An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote code execution (RCE) with root privileges on a target devi
- 7.6 High severity
Gxp1628 Firmware: Exposure of Information Through Directory Listing
Grandstream Networks GXP1628 <=1.0.4.130 is vulnerable to Incorrect Access Control. The device is configured with directory listing enabled, allowing unauthorized access to sensitive directories and files.
- 9.8 Critical severity
GXP2135: Improper Neutralization of Special Elements used in an OS Command
An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of Grandstream GXP2135 1.0.9.129, 1.0.11.74 and 1.0.11.79. A specially crafted network packet can lead to arbitrary command execution. An attacker can send a sequence of
- 8.8 High severity
UCM Series: Improper Neutralization of Parameter/Argument Delimiters
The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP request. Authentication may b
- 8.8 High severity
gxp1405_firmware: Execution with Unnecessary Privileges
An issue was discovered in Grandstream GXP14XX 1.0.8.9 and GXP16XX 1.0.7.13, allows remote attackers to escalate privileges via incorrect access control using an end-user session-identity token.
- 9.8 Critical severity
Grandstream GSD3710: Out-of-bounds Write
In Grandstream GSD3710 in its 1.0.11.13 version, it's possible to overflow the stack since it doesn't check the param length before using the sscanf instruction. Because of that, an attacker could create a socket and connect with a remote IP:port by opening a
- 9.8 Critical severity
Grandstream GSD3710: Out-of-bounds Write
an attacker with knowledge of user/pass of Grandstream GSD3710 in its 1.0.11.13 version, could overflow the stack since it doesn't check the param length before use the strcopy instruction. The explotation of this vulnerability may lead an attacker to execute
- 9.8 Critical severity
Grandstream Networks UCM6200 Series SQL Injection Exploited
The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in pass