CVE-2013-3962: Grandstream GXV3500

Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP_HD, GXV3500, and possibly other camera models before firmware 1.0.4.44, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

Affected products

• Grandstream GXV3500
• Grandstream GXV3501
• Grandstream GXV3504
• Grandstream GXV3601
• Grandstream GXV3601HD/LL
• Grandstream GXV3611HD/LL
• Grandstream GXV3615W/P
• Grandstream GXV3615WP Hd
• Grandstream GXV3651FHD
• Grandstream GXV3662HD
• Grandstream Gxv Device Firmware: up to and including 1.0.4.43; version 1.0.2.3 only; version 1.0.3.9 only; version 1.0.4.6 only; version 1.0.4.7 only; version 1.0.4.11 only; …

Published 2013-10-01. Last modified 2026-06-16.