CVE-2026-2329

🗓️ 18 Feb 2026 14:08:09Reported by rapid7Type

cve🔗 web.nvd.nist.gov📰️ 13 Media mentions👁 50 Views🌐 WEB

Unauthenticated stack buffer overflow on Grandstream GXP1600 series via values.get endpoint enabling root remote code execution.

Reporter	Title	Published	Views	Family All 17
attackerkb	CVE-2026-2329	18 Feb 202614:08	–	attackerkb
bdu_fstec	The vulnerability in the application programming interface `api.values.get` of Grandstream GXP microprogramming devices allows a perpetrator to execute arbitrary code with root privileges.	20 Feb 202600:00	–	bdu_fstec
circl	CVE-2026-2329	18 Feb 202614:15	–	circl
cnnvd	Grandstream GXP series 安全漏洞	18 Feb 202600:00	–	cnnvd
cvelist	CVE-2026-2329 Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflow	18 Feb 202614:08	–	cvelist
metasploit	GrandStream GXP1600 Unauthenticated Remote Code Execution	24 Feb 202618:57	–	metasploit
nvd	CVE-2026-2329	18 Feb 202615:18	–	nvd
osv	CVE-2026-2329	18 Feb 202615:18	–	osv
packetstorm	📄 GrandStream GXP1600 Unauthenticated Remote Code Execution	24 Feb 202600:00	–	packetstorm
ptsecurity	PT-2026-20432	18 Feb 202600:00	–	ptsecurity

NVD

Node

grandstream gxp1610_firmwareRange<1.0.7.81

AND

grandstream gxp1610Match-

Node

grandstream gxp1615_firmwareRange<1.0.7.81

AND

grandstream gxp1615Match-

Node

grandstream gxp1620_firmwareRange<1.0.7.81

AND

grandstream gxp1620Match-

Node

grandstream gxp1625_firmwareRange<1.0.7.81

AND

grandstream gxp1625Match-

Node

grandstream gxp1628_firmwareRange<1.0.7.81

AND

grandstream gxp1628Match-

Node

grandstream gxp1630_firmwareRange<1.0.7.81

AND

grandstream gxp1630Match-

[
  {
    "defaultStatus": "unaffected",
    "product": "GXP1610",
    "vendor": "Grandstream",
    "versions": [
      {
        "lessThanOrEqual": "1.0.7.80",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "GXP1615",
    "vendor": "Grandstream",
    "versions": [
      {
        "lessThanOrEqual": "1.0.7.80",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "GXP1620",
    "vendor": "Grandstream",
    "versions": [
      {
        "lessThanOrEqual": "1.0.7.80",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "GXP1625",
    "vendor": "Grandstream",
    "versions": [
      {
        "lessThanOrEqual": "1.0.7.80",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "GXP1628",
    "vendor": "Grandstream",
    "versions": [
      {
        "lessThanOrEqual": "1.0.7.80",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "GXP1630",
    "vendor": "Grandstream",
    "versions": [
      {
        "lessThanOrEqual": "1.0.7.80",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
github	www.github.com/rapid7/metasploit-framework/pull/20983
firmware	www.firmware.grandstream.com/Release_Note_GXP16xx_1.0.7.81.pdf
rapid7	www.rapid7.com/blog/post/ve-cve-2026-2329-critical-unauthenticated-stack-buffer-overflow-in-grandstream-gxp1600-voip-phones-fixed
psirt	www.psirt.grandstream.com/

Parameter	Position	Path	Description	CWE
request	request body	cgi-bin/api.values.get	Unauthenticated stack-based buffer overflow in GrandStream GXP1600 HTTP API endpoint; enables unauthenticated remote code execution (RCE) via POST payload.	CWE-121

17 Jun 2026 10:30Current

7High risk

Vulners AI Score7

CVSS 3.19.8

CVSS 49.3

EPSS0.40014

SSVC

CWE-121