by Kastro
Paper/Archive/CVE-2026-2329

CVE-2026-2329

Grandstream GXP1610 — Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflow

EPSS 42%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 98.7.987 × 2019.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote code execution (RCE) with root privileges on a target device. The vulnerability affects all six device models in the series: GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630.

Affected

ProductAffectedFixed inSource
GXP1610≤ 1.0.7.80–CNA
GXP1615≤ 1.0.7.80–CNA
GXP1620≤ 1.0.7.80–CNA
GXP1625≤ 1.0.7.80–CNA
GXP1628≤ 1.0.7.80–CNA
GXP1630≤ 1.0.7.80–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
rapid7 (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

writeuprapid7.com/blog/post/ve-cve-2026-2329-critical-unauthenticated-stack-buffer-overflow-in-grandstream-gxp1600-voip-phones-fixedadvisorypsirt.grandstream.comreffirmware.grandstream.com/Release_Note_GXP16xx_1.0.7.81.pdfexploitgithub.com/rapid7/metasploit-framework/pull/20983