https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-2329.htmlhttps://patchthecve.com/cve/CVE-2026-2329.htmlWed, 17 Jun 2026 10:30:47 +0000CRITICAL 9.8: An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote code execution (RCE) with root privileges on a target device. The vulnerability affects all six dehttps://patchthecve.com/cve/CVE-2025-28170.htmlhttps://patchthecve.com/cve/CVE-2025-28170.htmlSun, 05 Jul 2026 01:21:37 +0000HIGH 7.6: Grandstream Networks GXP1628 <=1.0.4.130 is vulnerable to Incorrect Access Control. The device is configured with directory listing enabled, allowing unauthorized access to sensitive directories and files.https://patchthecve.com/cve/CVE-2025-28171.htmlhttps://patchthecve.com/cve/CVE-2025-28171.htmlSun, 05 Jul 2026 16:19:19 +0000MEDIUM 6.5: An issue in Grandstream UCM6510 v.1.0.20.52 and before allows a remote attacker to obtain sensitive information via the Login function at /cgi and /webrtccgi.https://patchthecve.com/cve/CVE-2025-28172.htmlhttps://patchthecve.com/cve/CVE-2025-28172.htmlSun, 05 Jul 2026 01:21:38 +0000MEDIUM 6.5: Grandstream Networks UCM6510 v1.0.20.52 and before is vulnerable to Improper Restriction of Excessive Authentication Attempts. An attacker can perform an arbitrary number of authentication attempts using different passwords and eventually gain access to the targeted account using a brute force attachttps://patchthecve.com/cve/CVE-2024-32937.htmlhttps://patchthecve.com/cve/CVE-2024-32937.htmlWed, 17 Jun 2026 07:30:44 +0000HIGH 8.1: An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of Grandstream GXP2135 1.0.9.129, 1.0.11.74 and 1.0.11.79. A specially crafted network packet can lead to arbitrary command execution. An attacker can send a sequence of malicious packets to trigger this vulne