Gxp1628 Firmware vulnerabilities

3 known vulnerabilities in Gxp1628 Firmware from Grandstream. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  GXP1610: Stack-based Buffer Overflow

  CVE-2026-2329Feb 18, 2026GrandstreamEPSS 41.7%

  An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote code execution (RCE) with root privileges on a target devi

• 7.6 High severity

  Gxp1628 Firmware: Exposure of Information Through Directory Listing

  CVE-2025-28170Jul 29, 2025Grandstream

  Grandstream Networks GXP1628 <=1.0.4.130 is vulnerable to Incorrect Access Control. The device is configured with directory listing enabled, allowing unauthorized access to sensitive directories and files.

• 8.8 High severity

  gxp1405_firmware: Execution with Unnecessary Privileges

  CVE-2023-50015Mar 9, 2024Grandstream

  An issue was discovered in Grandstream GXP14XX 1.0.8.9 and GXP16XX 1.0.7.13, allows remote attackers to escalate privileges via incorrect access control using an end-user session-identity token.