CVE-2026-2329
Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflow
9.3
CRITICAL
CVSS 4.0
EPSS 41.7% · 99th pctCWE-121
2026-02-18
Description
An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote code execution (RCE) with root privileges on a target device. The vulnerability affects all six device models in the series: GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630.
Severity
CVSS 4.0 · CNA9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NSSVC · CISA-ADP
Exploitationpoc
Automatableyes
Technical impacttotal
Exploitation Context
as of October 17, 2026- Its current EPSS score (41.7%) is higher than that of 47% of CISA KEV entries.
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| Grandstream | Grandstream GXP1610 | 0 to 1.0.7.80 |
| Grandstream | Grandstream GXP1615 | 0 to 1.0.7.80 |
| Grandstream | Grandstream GXP1620 | 0 to 1.0.7.80 |
| Grandstream | Grandstream GXP1625 | 0 to 1.0.7.80 |
| Grandstream | Grandstream GXP1628 | 0 to 1.0.7.80 |
| Grandstream | Grandstream GXP1630 | 0 to 1.0.7.80 |
References
4 LinksVendor advisories
Exploits & PoCs
Third-party advisories
Record Details
Published
2026-02-18
Last updated
2026-02-18
Assigner (CNA)
rapid7
Credited to
Stephen Fewer, Senior Principal Security Researcher at Rapid7
Related
Tool categories
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.