Unauthenticated RCE in Grandstream GXP1600 /cgi-bin/api.values.get
CVE-2026-2329 is a critical unauthenticated stack-based buffer overflow in the web-based HTTP API of Grandstream GXP1600-series VoIP phones. The flaw is reachable in the default configuration via the /cgi-bin/api.values.get endpoint over HTTP, where the request parameter is parsed as colon-delimited identifiers and copied into a fixed 64-byte stack buffer without proper bounds checking. Supplying an overly long attacker-controlled request value can overflow the stack, corrupt adjacent memory, and enable control of execution flow. Rapid7 reported that the vulnerable code is in the native /app/bin/gs_web component and that exploitation can be achieved remotely without authentication, resulting in remote code execution as root. The issue affects GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630 devices running vulnerable firmware, with public Metasploit exploit and post-exploitation modules available. Firmware versions prior to 1.0.7.81 are described as affected in the provided content.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
61 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A stack overflow vulnerability in Grandstream GXP1600 VoIP devices that can grant attackers a root session (remote code execution).
A critical unauthenticated stack buffer overflow in Grandstream GXP1600 VoIP phones that can be exploited to gain root privileges; Metasploit modules are available and the issue is reported as fixed.
An unauthenticated stack overflow vulnerability in Grandstream GXP1600 VoIP devices enabling remote code execution and root access; follow-on activity includes credential theft and SIP traffic interception/packet capture once access is obtained.
An unauthenticated stack overflow leading to remote code execution (root) on Grandstream GXP1600-series VoIP devices, with follow-on modules for credential theft and SIP traffic capture.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.