CVE-2026-2329

🗓️ 18 Feb 2026 14:08:09Reported by rapid7Type

cve🔗 web.nvd.nist.gov📰️ 13 Media mentions👁 114 Views🌐 WEB

Unauthenticated stack buffer overflow on Grandstream GXP1600 series via values.get endpoint enabling root remote code execution.

Reporter	Title	Published	Views	Family All 20
GithubExploit	Exploit for Stack-based Buffer Overflow in Grandstream Gxp1610_Firmware	19 Aug 202621:48	–	githubexploit
attackerkb	CVE-2026-2329	18 Feb 202614:08	–	attackerkb
BDU FSTEC	Grandstream GXP Code Execution Root Privileges	20 Feb 202600:00	–	bdu_fstec
Circl	CVE-2026-2329	18 Feb 202614:15	–	circl
CNNVD	Grandstream GXP series security vulnerabilities	18 Feb 202600:00	–	cnnvd
Cvelist	CVE-2026-2329 Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflow	18 Feb 202614:08	–	cvelist
Kitploit	grandstream-cve-2026-2329-analysis	20 Oct 202602:54	–	kitploit
Metasploit	GrandStream GXP1600 Unauthenticated Remote Code Execution	18 Feb 202600:00	–	metasploit
NVD	CVE-2026-2329	18 Feb 202615:18	–	nvd
osv_cve	CVE-2026-2329	18 Feb 202615:18	–	osv_cve

NVD

Vulners

Node

AND

grandstream gxp1610_firmwareRange<1.0.7.81

grandstream gxp1610Match-

Node

AND

grandstream gxp1615_firmwareRange<1.0.7.81

grandstream gxp1615Match-

Node

AND

grandstream gxp1620_firmwareRange<1.0.7.81

grandstream gxp1620Match-

Node

AND

grandstream gxp1625_firmwareRange<1.0.7.81

grandstream gxp1625Match-

Node

AND

grandstream gxp1628_firmwareRange<1.0.7.81

grandstream gxp1628Match-

Node

AND

grandstream gxp1630_firmwareRange<1.0.7.81

grandstream gxp1630Match-

[
  {
    "defaultStatus": "unaffected",
    "product": "GXP1610",
    "vendor": "Grandstream",
    "versions": [
      {
        "lessThanOrEqual": "1.0.7.80",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "GXP1615",
    "vendor": "Grandstream",
    "versions": [
      {
        "lessThanOrEqual": "1.0.7.80",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "GXP1620",
    "vendor": "Grandstream",
    "versions": [
      {
        "lessThanOrEqual": "1.0.7.80",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "GXP1625",
    "vendor": "Grandstream",
    "versions": [
      {
        "lessThanOrEqual": "1.0.7.80",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "GXP1628",
    "vendor": "Grandstream",
    "versions": [
      {
        "lessThanOrEqual": "1.0.7.80",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "GXP1630",
    "vendor": "Grandstream",
    "versions": [
      {
        "lessThanOrEqual": "1.0.7.80",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
firmware	www.firmware.grandstream.com/Release_Note_GXP16xx_1.0.7.81.pdf
rapid7	www.rapid7.com/blog/post/ve-cve-2026-2329-critical-unauthenticated-stack-buffer-overflow-in-grandstream-gxp1600-voip-phones-fixed
psirt	www.psirt.grandstream.com/
github	www.github.com/rapid7/metasploit-framework/pull/20983

Parameter	Position	Path	Description	CWE
request	query param	/cgi-bin/api.values.get	An unauthenticated stack-based buffer overflow vulnerability in the /cgi-bin/api.values.get endpoint allows for remote code execution with root privileges.	CWE-121

17 Jun 2026 10:30Current

9.2Critical risk

Vulners AI Score9.2

CVSS 3.19.8

CVSS 49.3

EPSS0.41721

SSVC

CWE-121