CVE-2020-5738: Grandstream GXP1610 Firmware

High severity, CVSS 8.8. EPSS: 5.4% chance of exploitation in the next 30 days.

Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker uploads a specially crafted tar file to the HTTP /cgi-bin/upload_vpntar interface.

Affected products

• Grandstream GXP1610 Firmware: up to and including 1.0.4.152
• Grandstream GXP1615 Firmware: up to and including 1.0.4.152
• Grandstream GXP1620 Firmware: up to and including 1.0.4.152
• Grandstream GXP1625 Firmware: up to and including 1.0.4.152
• Grandstream GXP1628 Firmware: up to and including 1.0.4.152
• Grandstream GXP1630 Firmware: up to and including 1.0.4.152

Published 2020-04-14. Last modified 2026-06-17.