You do not have permission to edit this page, for the following reasons:
The Grandstream GXP1625 is an entry-level SIP desk phone with a small LCD and a single 10/100 Ethernet port. It carries two model-level CVEs. The serious one is CVE-2026-2329 (CVSS 9.8): an unauthenticated stack-based buffer overflow in the HTTP API endpoint /cgi-bin/api.values.get, which yields remote code execution without any credentials. CVE-2025-14186 (CVSS 3.5) affects a neighbouring endpoint on firmware 1.0.7.4. NVD lists gxp1625 explicitly in both CPE sets, so the exposure is confirmed at model level. Grandstream issues fixed firmware and security bulletins, but phones are usually updated only through a provisioning server, and many sit unmanaged on corporate or ISP-issued deployments. The device is rated D. It is not rated F because, unlike the camera models assessed alongside it, no botnet or mass-exploitation campaign naming this model was found, and the recorded attack surface is a single API endpoint rather than a whole suite of flaws. Values for hardware tampering, prior attacks, communications encryption, storage encryption, account management, brute-force protection, event logging and password policy are provisional because no model-level Grandstream documentation could be retrieved; the rating rests on the two CVE records.
For new submissions, pages will appear blank until approval.
Summary: This is a minor edit Watch this page
Save page Show preview Show changes Cancel
