Grandstream GXP1600 VoIP Phones Exposed to Unauthenticated Remote Code Execution
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-2329 | Unauthenticated RCE via stack buffer overflow in Grandstream GXP1600-series VoIP phones An unauthenticated stack-based buffer overflow (CWE-121) exists in the HTTP API endpoint /cgi-bin/api.values.get on Grandstream GXP1600-series VoIP desk phones. A remote attacker who can reach the phone's web API can send a crafted request to this endpoint with no credentials, overflowing a stack buffer and executing code with root privileges on the device. Full root control gives attackers a stealthy network foothold inside the victim network, with the potential to intercept calls or pivot to other systems. All six models in the series are affected: GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but EPSS assigns a 40% probability of exploitation within 30 days (99th percentile), so rapid weaponization is likely. Do: Upgrade all GXP1600-series phones (GXP1610/1615/1620/1625/1628/1630) to the latest firmware available from Grandstream, per the vendor advisory. Until patched, do not expose the phones' HTTP management interface to the internet, restrict access to it from untrusted networks, and review web server logs for requests to /cgi-bin/api.values.get as a sign of probing or compromise. Also check affected devices for indicators of exploitation such as unexpected call behavior, call interception, or unusual outbound traffic. | 9.3 | 40% |
| largehundreds of thousands of devices deployed, with likely tens of thousands of web interfaces internet-exposed |
Full article485 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananFeb 18, 2026Network Security / Enterprise Security
Cybersecurity researchers have disclosed a critical security flaw in the Grandstream GXP1600 series of VoIP phones that could allow an attacker to seize control of susceptible devices.
The vulnerability, tracked as CVE-2026-2329, carries a CVSS score of 9.3 out of a maximum of 10.0. It has been described as a case of unauthenticated stack-based buffer overflow that could result in remote code execution.
"A remote attacker can leverage CVE-2026-2329 to achieve unauthenticated remote code execution (RCE) with root privileges on a target device," Rapid7 researcher Stephen Fewer, who discovered and reported the bug on January 6, 2026, said.
According to the cybersecurity company, the issue is rooted in the device's web-based API service ("/cgi-bin/api.values.get") and is accessible in a default configuration without requiring authentication.
This endpoint is designed to fetch one or more configuration values from the phone, such as the firmware version number or the model, through a colon-delimited string in the "request" parameter (e.g., "request=68:phone_model"), which is then parsed to extract each identifier and append it to a 64 byte buffer on the stack.
"When appending another character to the small 64 byte buffer, no length check is performed to ensure that no more than 63 characters (plus the appended null terminator) are ever written to this buffer," Fewer explained. "Therefore, an attacker-controlled 'request' parameter can write past the bounds of the small 64 byte buffer on the stack, overflowing into adjacent stack memory."
This means that a malicious colon-delimited "request" parameter sent as part of an HTTP request to the "/cgi-bin/api.values.get" endpoint can be used to trigger a stack-based buffer overflow, allowing the threat actors to corrupt the stack contents and ultimately achieve remote code execution on the underlying operating system.
The vulnerability affects GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630 models. It has been addressed as part of a firmware update (version 1.0.7.81) released late last month.
In a Metasploit exploit module developed by Rapid7, it has been demonstrated that the vulnerability could be exploited to gain root privileges on a vulnerable device and chain it with a post-exploitation component to extract credentials stored on a compromised device.
Furthermore, the remote code execution capabilities can be weaponized to reconfigure the target device to use a malicious Session Initiation Protocol (SIP) proxy, effectively enabling the attacker to intercept phone calls to and from the device and eavesdrop on VoIP conversations. A SIP proxy is an intermediary server in VoIP networks to establish and manage voice/video calls between endpoints.
"This isn't a one-click exploit with fireworks and a victory banner," Rapid7's Douglas McKee said. "But the underlying vulnerability lowers the barrier in a way that should concern anyone operating these devices in exposed or lightly-segmented environments."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/02/grandstream-gxp1600-voip-phones-exposed.html