Code injection in Grandstream GXP1600 Series
Priority MEDIUM 46CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-94.
Summary
Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker adds an OpenVPN up script to the phone's VPN settings via the "Additional Settings" field in the web interface. When the VPN's connection is established, the user defined script is executed with root privileges.
Why it matters now
EPSS 0.05339 92nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Grandstream GXP1600 Series | up to 1.0.4.152 | — | No fix listed | CNA |
- Grandstream GXP1600 Series Vendor— Affected up to 1.0.4.152 Fixed in — No fix listed CNA
CPE configurations NVD · 12
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:grandstream:gxp1610_firmware:*:*:*:*:*:*:*:* | up to 1.0.4.152 | Vulnerable | Grandstream |
| cpe:2.3:h:grandstream:gxp1610:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Grandstream |
| cpe:2.3:o:grandstream:gxp1615_firmware:*:*:*:*:*:*:*:* | up to 1.0.4.152 | Vulnerable | Grandstream |
| cpe:2.3:h:grandstream:gxp1615:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Grandstream |
| cpe:2.3:o:grandstream:gxp1620_firmware:*:*:*:*:*:*:*:* | up to 1.0.4.152 | Vulnerable | Grandstream |
| cpe:2.3:h:grandstream:gxp1620:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Grandstream |
| cpe:2.3:o:grandstream:gxp1625_firmware:*:*:*:*:*:*:*:* | up to 1.0.4.152 | Vulnerable | Grandstream |
| cpe:2.3:h:grandstream:gxp1625:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Grandstream |
| cpe:2.3:o:grandstream:gxp1628_firmware:*:*:*:*:*:*:*:* | up to 1.0.4.152 | Vulnerable | Grandstream |
| cpe:2.3:h:grandstream:gxp1628:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Grandstream |
- cpe:2.3:o:grandstream:gxp1610_firmware:*:*:*:*:*:*:*:* Versions up to 1.0.4.152 Vulnerable ·Grandstream
- cpe:2.3:h:grandstream:gxp1610:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Grandstream
- cpe:2.3:o:grandstream:gxp1615_firmware:*:*:*:*:*:*:*:* Versions up to 1.0.4.152 Vulnerable ·Grandstream
- cpe:2.3:h:grandstream:gxp1615:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Grandstream
- cpe:2.3:o:grandstream:gxp1620_firmware:*:*:*:*:*:*:*:* Versions up to 1.0.4.152 Vulnerable ·Grandstream
- cpe:2.3:h:grandstream:gxp1620:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Grandstream
- cpe:2.3:o:grandstream:gxp1625_firmware:*:*:*:*:*:*:*:* Versions up to 1.0.4.152 Vulnerable ·Grandstream
- cpe:2.3:h:grandstream:gxp1625:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Grandstream
- cpe:2.3:o:grandstream:gxp1628_firmware:*:*:*:*:*:*:*:* Versions up to 1.0.4.152 Vulnerable ·Grandstream
- cpe:2.3:h:grandstream:gxp1628:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Grandstream
Show 2 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:grandstream:gxp1630_firmware:*:*:*:*:*:*:*:* | up to 1.0.4.152 | Vulnerable | Grandstream |
| cpe:2.3:h:grandstream:gxp1630:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Grandstream |
- cpe:2.3:o:grandstream:gxp1630_firmware:*:*:*:*:*:*:*:* Versions up to 1.0.4.152 Vulnerable ·Grandstream
- cpe:2.3:h:grandstream:gxp1630:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Grandstream
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-5739
- 2026-10-03 Alias added: GHSA-6p3v-7x9x-66jr
References
More Grandstream Gxp1610 Firmware vulnerabilities
- TI-2026-01969 Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflow CVSS 4.0CRITICAL 9.3
- TI-2020-04666 Link following in Grandstream GXP1600 Series CVSS 3.1HIGH 8.8
- TI-2018-12511 Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx… CVSS 3.0CRITICAL 9.8
- TI-2018-12510 A Malformed Input String to /cgi-bin/delete_CA on Grandstream GXP16xx VoIP 1.0.4.128… CVSS 3.0CRITICAL 9.8
- TI-2018-12509 A Malformed Input String to /cgi-bin/api-get_line_status on Grandstream GXP16xx VoIP… CVSS 3.0MEDIUM 5.3
Sources
- CVE-2020-5739 · CVE Program
- CVE-2020-5739 · NVD
- FIRST EPSS
- GHSA-6p3v-7x9x-66jr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences