CVE-2013-3963: Grandstream GXV3500

Medium severity, CVSS 6.8. EPSS: 0.9% chance of exploitation in the next 30 days.

Cross-site request forgery (CSRF) vulnerability in goform/usermanage in Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP_HD, GXV3500, and possibly other camera models allows remote attackers to hijack the authentication of unspecified victims for requests that add users.

Affected products

• Grandstream GXV3500
• Grandstream GXV3501
• Grandstream GXV3504
• Grandstream GXV3601
• Grandstream GXV3601HD/LL
• Grandstream GXV3611HD/LL
• Grandstream GXV3615W/P
• Grandstream GXV3615WP Hd
• Grandstream GXV3651FHD
• Grandstream GXV3662HD
• Grandstream Gxv Device Firmware: up to and including 1.0.4.43; version 1.0.2.3 only; version 1.0.3.9 only; version 1.0.4.6 only; version 1.0.4.7 only; version 1.0.4.11 only; …

Published 2013-10-01. Last modified 2026-06-16.