CVE-2020-25217

HIGH

Grandstream Grp2612 Firmware - Command Injection

Title source: rule

Grandstream GRP261x VoIP phone running firmware version 1.0.3.6 (Base) allows Command Injection as root in its administrative web interface.

Core 2

Core References

Third Party Advisory x_refsource_misc

Third Party Advisory x_refsource_misc

CVSS v3 7.2

EPSS 0.0309

EPSS Percentile 86.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-77

Status published

Products (7)

grandstream/grp2612_firmware 1.0.3.6

grandstream/grp2612p_firmware 1.0.3.6

grandstream/grp2612w_firmware 1.0.3.6

grandstream/grp2613_firmware 1.0.3.6

grandstream/grp2614_firmware 1.0.3.6

grandstream/grp2615_firmware 1.0.3.6

grandstream/grp2616_firmware 1.0.3.6

Published Mar 29, 2021

Tracked Since Feb 18, 2026