CVE-2024-32937 - CVE House
Back to Database
Status published High CVE-2024-32937

An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone...

Vulnerability Description

An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of Grandstream GXP2135 1.0.9.129, 1.0.11.74 and 1.0.11.79. A specially crafted network packet can lead to arbitrary command execution. An attacker can send a sequence of malicious packets to trigger this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-32937

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Discovered by Matthew Bernath of Cisco Talos.

References

More from Grandstream

View All →
CVE-2025-14186
Grandstream GXP1625 Network Status api.values.post cross site scripting
Medium 5.1
CVE-2024-0840
Grandstream UCM Series IP PBX HTTP Parameter Injection
High 8.8
CVE-2022-2070
Grandstream GSD3710 Stack-based Buffer Overflow
Critical 9.8
CVE-2022-2025
Grandstream GSD3710 Stack-based Buffer Overflow
Critical 9.8

Affected Vendor

Grandstream

View all reports →

Affected Software

GXP2135
Vulnerable Versions:
1.0.11.74, 1.0.11.79, 1.0.9.129

Timeline

Official Publish: July 3rd, 2024
Last Modified: November 4th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-78

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1005 Data from Local System
Collection
T1041 Exfiltration Over C2 Channel
Exfiltration