Back
Vendor security profile
Vonage
Click a year for its months, then a month to list its CVEs.
Latest CVEs for Vonage
6.5CVSS
CVE-2026-11820 · Jun 23, 2026
A flaw was found in the community.general Ansible collection's nexmo module.
The module constructs HTTP requests to the Vonage/Nexmo SMS API by encoding
API credentials (api_key and api_secret) into URL query parameters and
sending them via…
REDHATENTERPRISE LINUX 8.0
MEDIUM
7.8CVSS
CVE-2023-47304 · Dec 05, 2023
An issue was discovered in Vonage Box Telephone Adapter VDV23 version VDV21-3.2.11-0.5.1, allows local attackers to bypass UART authentication controls and read/write arbitrary values to the memory of the device.
PoC availableVONAGEVDV23 FIRMWARE VDV21-3.2.11-0.5.…MODIFIED
HIGH
7.7CVSS
CVE-2023-39421 · Sep 07, 2023
The RDPWin.dll component as used in the IRM Next Generation booking engine includes a set of hardcoded API keys for third-party services such as Twilio and Vonage. These keys allow unrestricted interaction with these services.
RESORTDATAINTERNET RESERVATION MODULE NEXT…MODIFIED
HIGH
7.5CVSS
CVE-2017-16902 · Nov 20, 2017
On the Vonage VDV-23 115 3.2.11-0.9.40 home router, sending a long string of characters in the loginPassword and/or loginUsername field to goform/login causes the router to reboot.
PoC availableVONAGEVDV-23 FIRMWARE 3.2.11-0.9.40MODIFIED
HIGH
5.4CVSS
CVE-2017-16843 · Nov 16, 2017
Vonage VDV-23 115 3.2.11-0.9.40 devices have stored XSS via the NewKeyword or NewDomain field to /goform/RgParentalBasic.
VONAGEVDV-23 FIRMWARE 3.2.11-0.9.40MODIFIED
MEDIUM
8.8CVSS
CVE-2017-16565 · Nov 06, 2017
Cross-Site Request Forgery (CSRF) in /cgi-bin/login on Vonage (Grandstream) HT802 devices allows attackers to authenticate a user via the login screen using the default password of 123 and submit arbitrary requests.
PoC availableGRANDSTREAMHT802 FIRMWAREMODIFIED
HIGH
5.4CVSS
CVE-2017-16564 · Nov 06, 2017
Stored Cross-site scripting (XSS) vulnerability in /cgi-bin/config2 on Vonage (Grandstream) HT802 devices allows remote authenticated users to inject arbitrary web script or HTML via the DHCP vendor class ID field (P148).
PoC availableGRANDSTREAMHT802 FIRMWAREMODIFIED
MEDIUM
8.0CVSS
CVE-2017-16563 · Nov 06, 2017
Cross-Site Request Forgery (CSRF) in the Basic Settings screen on Vonage (Grandstream) HT802 devices allows attackers to modify settings, related to cgi-bin/update.
PoC availableGRANDSTREAMHT802 FIRMWAREMODIFIED
HIGH
10.0CVSS
CVE-2007-5791 · Nov 01, 2007
The Vonage Motorola Phone Adapter VT 2142-VD does not properly verify that a SIP INVITE message originated from a legitimate server, which allows remote attackers to send spoofed INVITE messages, as demonstrated by a flood of messages trigg…
VONAGEMOTOROLA PHONE ADAPTER VT2142-VDMODIFIED
HIGH
7.1CVSS
CVE-2007-5792 · Nov 01, 2007
The Vonage Motorola Phone Adapter VT 2142-VD does not encrypt RTP packets, which might allow remote attackers to eavesdrop by sniffing the network and reconstructing the RTP session.
VONAGEMOTOROLA PHONE ADAPTER VT2142-VDMODIFIED
HIGH
10.0CVSS
CVE-2007-3047 · Jun 05, 2007
The Vonage VoIP Telephone Adapter has a default administrator username "user" and password "user," which allows remote attackers to obtain administrative access.
VONAGEVOIP TELEPHONE ADAPTERMODIFIED
HIGH