What’s Vulnerable › Vulnerabilities

CVE-2026-2329: Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflow

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 41.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-18 · updated 2026-06-17
• Weakness: CWE-121

Description

An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote code execution (RCE) with root privileges on a target device. The vulnerability affects all six device models in the series: GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630.

Affected products

• Grandstream Gxp1610 Firmware: before 1.0.7.81 — fixed in 1.0.7.81
• Grandstream Gxp1615 Firmware: before 1.0.7.81 — fixed in 1.0.7.81
• Grandstream Gxp1620 Firmware: before 1.0.7.81 — fixed in 1.0.7.81
• Grandstream Gxp1625 Firmware: before 1.0.7.81 — fixed in 1.0.7.81
• Grandstream Gxp1628 Firmware: before 1.0.7.81 — fixed in 1.0.7.81
• Grandstream Gxp1630 Firmware: before 1.0.7.81 — fixed in 1.0.7.81

How to fix

Upgrade to a fixed version: Grandstream Gxp1610 Firmware 1.0.7.81; Grandstream Gxp1615 Firmware 1.0.7.81; Grandstream Gxp1620 Firmware 1.0.7.81; Grandstream Gxp1625 Firmware 1.0.7.81; Grandstream Gxp1628 Firmware 1.0.7.81; Grandstream Gxp1630 Firmware 1.0.7.81. Check the vendor advisory for mitigations.

References

• https://firmware.grandstream.com/Release_Note_GXP16xx_1.0.7.81.pdf
• https://github.com/rapid7/metasploit-framework/pull/20983
• https://psirt.grandstream.com/
• https://www.rapid7.com/blog/post/ve-cve-2026-2329-critical-unauthenticated-stack-buffer-overflow-in-grandstream-gxp1600-voip-phones-fixed

Get alerted when CVE-2026-2329 or the next vulnerability affects your stack