Grandstream

Grandstream manufactures a well-represented portfolio of unified communications and IP telephony devices, including IP PBX systems, IP phones, and analog gateways that span enterprise and small-business deployments. Vulnerabilities affecting the vendor skew strongly toward critical-severity outcomes and frequently acquire public exploit code, reflecting the internet-facing nature and administrative privileges of these communications appliances. The exposure recurs across firmware and application components of flagship products such as the UCM6204 IP PBX and GXP1628 IP phone, clustering around command injection, SQL injection, cross-site request forgery, and out-of-bounds write conditions that are typical of embedded network devices with web administration interfaces. Defenders should prioritize patching these devices and restricting management access to trusted networks, since compromised communications infrastructure can enable call interception, credential harvesting, and lateral movement. Current severity, exploitation activity, and exposure counts are shown alongside this summary.