Grandstream · Grandstream Gxp16Xx Voip · CVE-2018-17564
**Name of the Vulnerable Software and Affected Versions**
Grandstream GXP16xx VoIP version 1.0.4.128
**Description**
The issue arises from a malformed input string sent to the "/cgi-bin/delete CA" API endpoint, allowing attackers to delete configuration parameters and gain admin access to the device.
**Recommendations**
For Grandstream GXP16xx VoIP version 1.0.4.128, as a temporary workaround, consider restricting access to the "/cgi-bin/delete CA" API endpoint until a patch is available.