Grandstream GXP1600 VoIP Phones Exposed to Unauthenticated Remote Code Execution

Summary: Rapid7 researchers disclosed CVE-2026-2329, a stack-based buffer overflow in the Grandstream GXP1600 series VoIP phones' web API endpoint /cgi-bin/api.values.get, rated CVSS 9.3 and exploitable without authentication in the default configuration. The flaw, reported by researcher Stephen Fewer on January 6, 2026, lets an attacker write past a 64-byte stack buffer via the colon-delimited request parameter to gain root-level remote code execution, and affects GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630 models, with a fix in firmware version 1.0.7.81.
What's compelling: Rapid7 demonstrated the bug in a Metasploit module that gains root and can reconfigure the phone to use a malicious SIP proxy, letting an attacker intercept and eavesdrop on VoIP calls - and the vulnerable endpoint needs no credentials in the default configuration.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-2329
Related: ⚡ Weekly Recap: Double-Tap Skimmers, Prompt Spy AI, 30Tbps DDoS, Docker Malware & More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026