CVE-2025-14186: Grandstream GXP1625 Network Status api.values.post cross site scripting
A security flaw has been discovered in Grandstream GXP1625 1.0.7.4. The impacted element is an unknown function of the file /cgi-bin/api.values.post of the component Network Status Page. Performing manipulation of the argument vpnip results in basic cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14186?
CVE-2025-14186 is classified as a high severity cross-site scripting vulnerability.
What are the impacts of CVE-2025-14186?
CVE-2025-14186 can allow an attacker to exploit vulnerable systems and execute arbitrary scripts in the context of a user’s session.
How do I fix CVE-2025-14186?
To fix CVE-2025-14186, it is recommended to update the Grandstream GXP1625 device firmware to the latest version provided by the vendor.
Which devices are affected by CVE-2025-14186?
CVE-2025-14186 specifically affects the Grandstream GXP1625 model running version 1.0.7.4.
Can CVE-2025-14186 be exploited remotely?
Yes, CVE-2025-14186 can be exploited remotely by manipulating the vpn_ip argument in the Network Status Page.