Grandstream GXP1625 (GXP1625)

Grandstream GXP1625 (GXP1625)
Security Grade D Calculator v1	Grandstream GXP1625 (GXP1625) Brand: Grandstream (Parent: Grandstream Networks, Inc.) Category: IP Phone • Model / Gen: GXP1625 Release Date: 2013-01-01 • Status: In sale Classification Date: 2026-10-25 • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	None	—	No published hardware-tampering research specific to this model was found as of 2026-10. The desk phone housing is screwed shut and exposes no serviceable internal port from outside.
Known vulnerabilities	Rare	[https://nvd.nist.gov/vuln/detail/CVE-2026-2329 https://nvd.nist.gov/vuln/detail/CVE-2025-14186 🔗 Proof]	Two CVEs list gxp1625 in their CPE configurations. CVE-2026-2329 (CVSS 9.8) is an unauthenticated stack-based buffer overflow in the HTTP API endpoint /cgi-bin/api.values.get that allows unauthenticated remote code execution. CVE-2025-14186 (CVSS 3.5) is a lower-severity flaw in /cgi-bin/api.values.post on firmware 1.0.7.4.
Prior attacks	None	—	No campaign naming this model was found. IP desk phones are a recognised but comparatively low-volume botnet target compared with cameras, and no recorded attack against GXP1625 was located. Provisional value.
Updatability	Rare	🔗 Proof	Grandstream publishes firmware and security bulletins, but updates are applied manually through the web interface or a provisioning server; many units are deployed by an operator and never updated, so field devices commonly run old builds.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	CVE-2026-2329 is exploitable without any credentials against the device HTTP API, so the authentication layer between this phone and connecting systems provides no real barrier on that endpoint.
Communications	No encryption	—	The web management interface and SIP signalling are reachable over plaintext HTTP and UDP/TCP SIP by default; TLS and SRTP are supported but not enforced. Provisional value, not directly evidenced for this model.
Storage	No encryption	—	Configuration including SIP account credentials is stored in the phone flash without documented encryption. Provisional value, not directly evidenced for this model.
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	—	The web and LCD interfaces offer a fixed admin/user split backed by a provisioning profile, without fine-grained roles. Provisional value, not directly evidenced for this model.
Authentication	Basic	🔗 Proof	Web and LCD login exist, but CVE-2026-2329 allows an unauthenticated remote attacker to execute code through the HTTP API without passing authentication at all.
Brute-force protection	Absent	—	No documented account lockout or rate limiting on failed web logins. Provisional value, not directly evidenced for this model.
Event logging	Partial logging	—	The phone keeps a local syslog-style event list viewable in the web interface, with no centralised or tamper-evident logging by default. Provisional value, not directly evidenced for this model.
Passwords	Require change after setup	—	CVE-2026-2329 requires no credentials at all, so the existence of a default admin password is only one part of the exposure; the phone does ship with a documented default admin credential that must be changed at provisioning.
Category Score	Score: 3 / 3

Technical Specifications

Property	Details
Operating System & App	Embedded Linux (Companion App: )
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: Ethernet (RJ45), PoE
Physical (Dimensions & Mass)	Dimensions: • Mass:

The Grandstream GXP1625 is an entry-level SIP desk phone with a small LCD and a single 10/100 Ethernet port. It carries two model-level CVEs. The serious one is CVE-2026-2329 (CVSS 9.8): an unauthenticated stack-based buffer overflow in the HTTP API endpoint /cgi-bin/api.values.get, which yields remote code execution without any credentials. CVE-2025-14186 (CVSS 3.5) affects a neighbouring endpoint on firmware 1.0.7.4. NVD lists gxp1625 explicitly in both CPE sets, so the exposure is confirmed at model level. Grandstream issues fixed firmware and security bulletins, but phones are usually updated only through a provisioning server, and many sit unmanaged on corporate or ISP-issued deployments. The device is rated D. It is not rated F because, unlike the camera models assessed alongside it, no botnet or mass-exploitation campaign naming this model was found, and the recorded attack surface is a single API endpoint rather than a whole suite of flaws. Values for hardware tampering, prior attacks, communications encryption, storage encryption, account management, brute-force protection, event logging and password policy are provisional because no model-level Grandstream documentation could be retrieved; the rating rests on the two CVE records.