CVE-2016-1520: Grandstream Wave

High severity, CVSS 7.8. EPSS: 2.2% chance of exploitation in the next 30 days.

The Grandstream Wave app 1.0.1.26 and earlier for Android does not use HTTPS when retrieving update information, which might allow man-in-the-middle attackers to execute arbitrary code via a crafted application.

Affected products

• Grandstream Wave: up to and including 1.0.1.26

Published 2017-04-21. Last modified 2026-06-17.