CVE-2024-32937: Grandstream GXP2135 Firmware

Critical severity, CVSS 9.8. EPSS: 27% chance of exploitation in the next 30 days.

An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of Grandstream GXP2135 1.0.9.129, 1.0.11.74 and 1.0.11.79. A specially crafted network packet can lead to arbitrary command execution. An attacker can send a sequence of malicious packets to trigger this vulnerability.

Affected products

• Grandstream GXP2135 Firmware: version 1.0.9.129 only; version 1.0.11.74 only; version 1.0.11.79 only

Published 2024-07-03. Last modified 2026-06-17.