Grandstream vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Grandstream flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2020-5722 Grandstream Networks UCM6200 Series SQL InjectionExploited since Jan 28, 2022 · CVSS 9.8

Latest high and critical flaws

• CVE-2026-2329 An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get.Critical 9.3 · Feb 18, 2026
• CVE-2025-40979 DLL search order hijacking vulnerability in the wave.exe executable for Windows 11, version 1.27.8.High 7 · Sep 10, 2025
• CVE-2025-28170 Grandstream Networks GXP1628 <=1.0.4.130 is vulnerable to Incorrect Access Control.High 7.6 · Jul 29, 2025
• CVE-2024-32937 An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of Grandstream GXP2135 1.0.9.129, 1.0.11.74 and 1.0.11.79.High 8.1 · Jul 3, 2024
• CVE-2024-0840 The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface.High 8.8 · Apr 29, 2024
• CVE-2023-50015 An issue was discovered in Grandstream GXP14XX 1.0.8.9 and GXP16XX 1.0.7.13, allows remote attackers to escalate privileges via incorrect access control using aHigh 8.8 · Mar 9, 2024
• CVE-2022-2070 In Grandstream GSD3710 in its 1.0.11.13 version, it's possible to overflow the stack since it doesn't check the param length before using the sscanf instructionCritical 9.8 · Sep 23, 2022
• CVE-2022-2025 an attacker with knowledge of user/pass of Grandstream GSD3710 in its 1.0.11.13 version, could overflow the stack since it doesn't check the param length beforeCritical 9.8 · Sep 23, 2022
• CVE-2021-37915 An issue was discovered on the Grandstream HT801 Analog Telephone Adaptor before 1.0.29.8.High 8.8 · Oct 28, 2021
• CVE-2021-37748 Multiple buffer overflows in the limited configuration shell (/sbin/gs_config) on Grandstream HT801 devices before 1.0.29 allow remote authenticated users to exHigh 8.8 · Oct 28, 2021
• CVE-2020-25218 Grandstream GRP261x VoIP phone running firmware version 1.0.3.6 (Base) allow Authentication Bypass in its administrative web interface.Critical 9.8 · Mar 29, 2021
• CVE-2020-25217 Grandstream GRP261x VoIP phone running firmware version 1.0.3.6 (Base) allows Command Injection as root in its administrative web interface.High 7.2 · Mar 29, 2021
• CVE-2020-5763 Grandstream HT800 series firmware version 1.0.17.5 and below contain a backdoor in the SSH service.High 8.8 · Jul 29, 2020
• CVE-2020-5762 Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to a denial of service attack against the TR-069 service.High 7.5 · Jul 29, 2020
• CVE-2020-5761 Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to CPU exhaustion due to an infinite loop in the TR-069 service.High 7.5 · Jul 29, 2020
• CVE-2020-5760 Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to an OS command injection vulnerability.High 7.8 · Jul 29, 2020
• CVE-2020-5759 Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via SSH.Critical 9.8 · Jul 17, 2020
• CVE-2020-5758 Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP.High 8.8 · Jul 17, 2020
• CVE-2020-5757 Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP.Critical 9.8 · Jul 17, 2020
• CVE-2020-5739 Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker adds an OpenVPN up script to thHigh 8.8 · Apr 14, 2020
• CVE-2020-5738 Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker uploads a specially crafted tarHigh 8.8 · Apr 14, 2020
• CVE-2020-5726 The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888.High 7.5 · Mar 30, 2020
• CVE-2020-5724 The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint.High 7.5 · Mar 30, 2020
• CVE-2020-5723 The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database.Critical 9.8 · Mar 30, 2020
• CVE-2020-5722 Grandstream Networks UCM6200 Series SQL InjectionExploited · Critical 9.8 · Mar 23, 2020