Not scored
CVE-2026-2329
Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflow
GrandstreamGXP1610
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
42%probability of exploitation in the next 30 days
Higher than 99% of scored CVEs
SeverityCVSS
–Not scored yet
Description NVD
An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote code execution (RCE) with root privileges on a target device. The vulnerability affects all six device models in the series: GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630.
Coverage 3 articles · 3 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 18 Feb · 16:51 UTC | The Hacker News | Grandstream GXP1600 VoIP Phones Exposed to Unauthenticated Remote Code Execution |
| Wed 18 Feb · 21:51 UTC | Dark Reading | Critical Grandstream VoIP Bug Highlights SMB Security Blind Spot |
| Mon 23 Feb · 00:37 UTC | SecurityWeek | CVE-2026-2329 lets attackers hijack Grandstream GXP1600 calls |
- CVE-2026-2329 lets attackers hijack Grandstream GXP1600 callsSecurityWeek
- Critical Grandstream VoIP Bug Highlights SMB Security Blind SpotDark Reading
- Grandstream GXP1600 VoIP Phones Exposed to Unauthenticated Remote Code ExecutionThe Hacker News · first in our coverage