CVE-2026-2329 is a critical unauthenticated stack-based buffer overflow vulnerability in the HTTP API of Grandstream GXP16xx series IP phones, specifically affecting the /cgi-bin/api.values.get endpoint. This flaw allows a remote attacker to achieve unauthenticated remote code execution (RCE) with root privileges. With a CVSS score of 9.8 (Critical), the vulnerability is easily exploitable over the network with low attack complexity, leading to complete compromise of confidentiality, integrity, and availability. While not yet listed in CISA's KEV catalog, exploit code is confirmed to exist via a Metasploit module, and the vulnerability has garnered significant community discussion and media coverage, indicating high awareness and potential for future exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.0.7.81CPE matchmatch criteria | cpe:2.3:o:grandstream:gxp1610_firmware:*:*:*:*:*:*:*:* | ||
< 1.0.7.81CPE matchmatch criteria | cpe:2.3:o:grandstream:gxp1615_firmware:*:*:*:*:*:*:*:* | ||
< 1.0.7.81CPE matchmatch criteria | cpe:2.3:o:grandstream:gxp1620_firmware:*:*:*:*:*:*:*:* | ||
< 1.0.7.81CPE matchmatch criteria | cpe:2.3:o:grandstream:gxp1625_firmware:*:*:*:*:*:*:*:* | ||
< 1.0.7.81CPE matchmatch criteria | cpe:2.3:o:grandstream:gxp1628_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.