CVE-2026-2329

CRITICAL EPSS 98.4%
Published Feb 18, 20264mo ago · Modified Jun 17, 20261w ago
9.3 CVSS 4.0
Critical
Find Similar
Published Feb 18, 2026 4mo ago
Last Modified Jun 17, 2026 1w ago

Description

An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote code execution (RCE) with root privileges on a target device. The vulnerability affects all six device models in the series: GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630.

CVSS Details

Base Score
9.3
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
98.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-121

Affected Products 12

VendorProductVersionRange
grandstreamgxp1610_firmware* <1.0.7.81
grandstreamgxp1610*any
grandstreamgxp1615_firmware* <1.0.7.81
grandstreamgxp1615*any
grandstreamgxp1620_firmware* <1.0.7.81
grandstreamgxp1620*any
grandstreamgxp1625_firmware* <1.0.7.81
grandstreamgxp1625*any
grandstreamgxp1628_firmware* <1.0.7.81
grandstreamgxp1628*any
grandstreamgxp1630_firmware* <1.0.7.81
grandstreamgxp1630*any

References 4

  • firmware.grandstream.com https://firmware.grandstream.com/Release_Note_GXP16xx_1.0.7.81.pdf
    ProductRelease Notes
  • github.com https://github.com/rapid7/metasploit-framework/pull/20983
    PatchVDB Entry
  • psirt.grandstream.com https://psirt.grandstream.com/
    Vendor Advisory
  • rapid7.com https://www.rapid7.com/blog/post/ve-cve-2026-2329-critical-unauthenticated-stack-buffer-overflow-in-grandstream-gxp1600-voip-phones-fixed
    Third Party AdvisoryVDB Entry

Remediation

  • github.com https://github.com/rapid7/metasploit-framework/pull/20983
    PatchVDB Entry