CVE-2026-2329
📋 TL;DR
An unauthenticated stack-based buffer overflow vulnerability in Grandstream GXP1600 series VoIP phones allows remote attackers to execute arbitrary code with root privileges without authentication. This affects all six device models in the GXP16xx series. Attackers can completely compromise affected devices over the network.
💻 Affected Systems
- GXP1610
- GXP1615
- GXP1620
- GXP1625
- GXP1628
- GXP1630
📦 What is this software?
Gxp1610 Firmware by Grandstream
Gxp1615 Firmware by Grandstream
Gxp1620 Firmware by Grandstream
Gxp1625 Firmware by Grandstream
Gxp1628 Firmware by Grandstream
Gxp1630 Firmware by Grandstream
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover with root privileges, allowing installation of persistent malware, credential theft, lateral movement, and use as attack platform
Likely Case
Device compromise leading to eavesdropping on calls, credential harvesting, and participation in botnets
If Mitigated
Limited impact if devices are behind firewalls with strict inbound rules and network segmentation
🎯 Exploit Status
Metasploit module available, making exploitation trivial for attackers with basic skills
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.7.81
Vendor Advisory: https://psirt.grandstream.com/
Restart Required: Yes
Instructions:
1. Download firmware 1.0.7.81 from Grandstream support portal. 2. Log into device web interface. 3. Navigate to Maintenance > Upgrade. 4. Upload firmware file. 5. Click Upgrade and wait for reboot.
🔧 Temporary Workarounds
Disable HTTP API
allDisable the vulnerable HTTP API endpoint if not required
Navigate to web interface > Security > HTTP/HTTPS > Disable HTTP API
Network Access Control
linuxRestrict access to device management interface using firewall rules
iptables -A INPUT -p tcp --dport 80 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
🧯 If You Can't Patch
- Segment VoIP devices on isolated VLAN with strict firewall rules
- Implement network-based intrusion detection to monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check firmware version via web interface: Login > Status > System Status > Firmware VersionCheck Version:
curl -s http://device-ip/cgi-bin/api.values.get?name=system.firmware.versionVerify Fix Applied:
Verify firmware version shows 1.0.7.81 or higher after upgrade📡 Detection & Monitoring
Log Indicators:
- Multiple failed HTTP requests to /cgi-bin/api.values.get
- Unusual process execution in system logs
- Unexpected firmware version changes
Network Indicators:
- HTTP POST requests to /cgi-bin/api.values.get with large payloads
- Unusual outbound connections from VoIP devices
- Traffic to known exploit servers
SIEM Query:
source="voip-firewall" dest_port=80 AND uri_path="/cgi-bin/api.values.get" AND content_length>1000