PT-2025-49397 · Grandstream · Grandstream Gxp1625

Cccll · Publicado 2025-12-07 · Atualizado 2025-12-07 · CVE-2025-14186

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Grandstream GXP1625 version 1.0.7.4

Description A security flaw exists in Grandstream GXP1625 version 1.0.7.4. The issue is related to basic cross site scripting, which can be triggered by manipulating the vpn ip argument within an unknown function of the file /cgi-bin/api.values.post of the Network Status Page component. Remote exploitation is possible. The exploit has been released publicly. The vendor was contacted regarding this disclosure but did not respond.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the /cgi-bin/api.values.post file to minimize the risk of exploitation.

Exploit

Correção

Special Elements Injection

XSS

Enumeração de Fraquezas

CWE-74

CWE-80

Identificadores relacionados

CVE-2025-14186

Produtos afetados

Grandstream Gxp1625

Referências · 7

• 🔥 https://drive.google.com/file/d/1rsskCaj4TwiaGG9_VYabjnKMP_zAry7L/view?usp=sharing · Exploit
• https://vuldb.com/?ctiid.334606 · Nota
• https://vuldb.com/?submit.698650 · Nota
• https://t.me/CVEtracker/39038 · Publicação no Telegram
• https://vuldb.com/?id.334606 · Nota
• https://t.me/cveNotify/145023 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-14186 · Nota de Segurança