Record each 1.35 release track independently
Grandstream describes Wave as a UCM ecosystem client rather than a generic third-party SIP softphone. Its September 21, 2026 release set names four different builds: Desktop 1.35.6 for Windows and macOS, Web 1.0.35.7, Android 1.0.35.7 and iOS 1.35.7. Preserve the exact client, platform, installation or browser channel, UCM family and firmware, RemoteConnect path and enabled server features. A matching 1.35 family label does not prove feature or defect parity.
Wave Web is built into the UCM6300 series, while Desktop and mobile have separate distribution paths. The mobile notes direct Android users to Google Play or Grandstream's download service and iOS users to Apple's App Store. An entry on the release index establishes publisher documentation, not installation, store availability, operating-system support, compatibility or successful operation on a particular device.
Keep extension identity and Wave login distinct
The desktop guide uses the UCM SIP extension number, server address and user-portal password for Wave login and explicitly distinguishes a Wave password reset from the endpoint SIP-account password. The mobile guide documents credentials, QR code and biometric sign-in, while the UCM can expose additional identity-provider paths. Preserve the actual login mode, account issuer, device list, session revocation and multi-device policy.
A UCM-generated QR or barcode can simplify enrollment but remains credential-bearing configuration. Control its audience and lifetime, and do not place it in shared tickets or screenshots. A successful login does not prove inbound routing, public-number identity, voicemail, transfer, media or emergency behavior.
Bound SSO, AI, remote control and WhatsApp to their owners
The 1.35 release notes add SAML SSO, Windows AD and Google Workspace login across Desktop, Web and mobile, but say those services must be configured on the UCM. Record the identity provider, redirect and assertion policy, account mapping, session lifetime, revocation and break-glass path. A Wave login does not prove SIP registration, call authorization or emergency identity, and a working extension password does not prove the external identity flow.
Grandstream labels the new AI functions beta, says signups were closed in the reviewed notes and requires UCM configuration and user permissions. Transcription, summaries, translation, voicemail processing and CRM synchronization introduce recording and derived-data boundaries; establish authorization, notice, retention, export, deletion and access before enabling them. Desktop remote control requires both parties to run 1.35.x or later and is unavailable for named call types, while WhatsApp calling requires UCM63xx 1.0.35.x or later and a configured business integration. These are gated workflows, not universal Wave capabilities.
Verify protection and RemoteConnect as separate paths
The Wave desktop guide lists SIP over TLS, SRTP and HTTPS. Those labels cover different legs and do not by themselves establish certificate trust, negotiated media protection or confidentiality across a trunk, recording platform or public telephone network. Capture the server identity, TLS validation result and negotiated media for the exact client and call.
Grandstream positions UCM RemoteConnect as a NAT-traversal path compatible with Wave. Treat it as an additional cloud and routing dependency with account ownership, region, plan, availability, logging and revocation questions. Do not transfer a product-page security adjective or service reliability claim into an observed deployment result.
Test mobile background delivery and multi-device policy
The current mobile guide says background mode, notification permission, background data and battery optimization can affect receipt of calls and messages. It also exposes a policy that can block mobile notifications while desktop is active and later resume them. Record the setting on the UCM, every logged-in device and the phone operating system rather than treating a foreground status indicator as locked-screen evidence.
Test extended idle, locked screen, app restart, device reboot, Wi-Fi and mobile-data changes, desktop-active and desktop-idle states, delayed notifications and revocation of an old handset. Confirm which device rings, how missed calls are recorded and whether answering on one client clears the others. The documented setting is not a guarantee for a particular mobile power policy.
Pilot calls, collaboration and emergency behavior separately
Run desktop, mobile and browser acceptance as separate matrices: login, inbound and outbound calls, selected identity, audio devices, DTMF, hold, attended and blind transfer, voicemail indication, meetings, reconnect, sign-out and diagnostics. Browser permission and sleep behavior need their own evidence. CTI, server recording, contact visibility and collaboration controls inherit UCM permissions and should not be assumed from client availability.
Confirm emergency routing, callback, location and an approved test procedure with the PBX and carrier owners. Keep an independent fallback for critical users. No app, browser, PBX, RemoteConnect service, QR enrollment, identity provider, certificate, media protection, notification, device, emergency route, availability, price, audio quality or live-call behavior was validated for this guide.
Sources & applicability
Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.
- Grandstream Wave product page ↗
- Grandstream Wave datasheet ↗
- Grandstream Wave release tracks ↗
- Grandstream Wave Desktop user guide ↗
- Grandstream Wave Mobile user guide ↗
- Grandstream Wave Web user guide ↗
- Grandstream UCM RemoteConnect user guide ↗
- Wave Desktop 1.35.6 release notes ↗
- Wave Web 1.0.35.7 release notes ↗
- Wave Android 1.0.35.7 and iOS 1.35.7 release notes ↗
Examples require adaptation to your topology. No live PBX or hardware testing is claimed.