Grandstream GXP1600 VoIP Phones Exposed to Unauthenticated Remote Code Execution

"Cybersecurity researchers have disclosed a critical security flaw in the Grandstream GXP1600 series of VoIP phones that could allow an attacker to seize control of susceptible devices. The vulnerability, tracked as CVE-2026-2329, carries a CVSS score of 9.3 out of a maximum of 10.0. It has been described as a case of unauthenticated stack-based buffer overflow that could result in remote code execution."

"According to the cybersecurity company, the issue is rooted in the device's web-based API service ("/cgi-bin/api.values.get") and is accessible in a default configuration without requiring authentication. This endpoint is designed to fetch one or more configuration values from the phone, such as the firmware version number or the model, through a colon-delimited string in the "request" parameter (e.g., "request=68:phone_model"), which is then parsed to extract each identifier and append it to a 64 byte buffer on the stack."

""When appending another character to the small 64 byte buffer, no length check is performed to ensure that no more than 63 characters (plus the appended null terminator) are ever written to this buffer," Fewer explained. "Therefore, an attacker-controlled 'request' parameter can write past the bounds of the small 64 byte buffer on the stack, overflowing into adjacent stack memory.""

An unauthenticated stack-based buffer overflow (CVE-2026-2329) affects Grandstream GXP1600 series VoIP phones and can enable unauthenticated remote code execution with root privileges. The flaw has a CVSS score of 9.3 and originates in the device's web-based API service (/cgi-bin/api.values.get), which is accessible in default configurations. The endpoint parses a colon-delimited 'request' parameter (e.g., 'request=68:phone_model') and appends identifiers to a 64-byte stack buffer without length checks. Appending additional characters can overwrite adjacent stack memory, allowing attackers to corrupt control data and execute arbitrary code. Rapid7 researcher Stephen Fewer discovered and reported the vulnerability on January 6, 2026.

Read at The Hacker News