Grandstream GXP1600 VoIP Phones Vulnerable to Unauthenticated Remote Code Execution Flaw

Post Views: 3

Grandstream GXP1600 VoIP Phones Vulnerable to Unauthenticated Remote Code Execution

A recently discovered vulnerability in the Grandstream GXP1600 series of VoIP phones has been found to expose the devices to unauthenticated remote code execution.

Vulnerability Details

The flaw, identified as CVE-2026-2329, carries a CVSS score of 9.3 out of 10 and is described as a stack-based buffer overflow that can be triggered without requiring authentication.

The vulnerability is rooted in the device’s web-based API service, specifically the “/cgi-bin/api.values.get” endpoint, which is designed to fetch configuration values from the phone.

According to researchers, the vulnerability occurs when the device attempts to parse the “request” parameter and append it to a 64-byte buffer on the stack. However, no length check is performed to ensure that the buffer is not overflowed, allowing an attacker to write past the bounds of the buffer and corrupt the stack contents.

This can ultimately lead to remote code execution on the underlying operating system, allowing an attacker to gain root privileges on the device.

Furthermore, the vulnerability can be chained with a post-exploitation component to extract credentials stored on the compromised device.

Affected Devices

The vulnerability affects several models of Grandstream GXP1600 VoIP phones, including the GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630.

A firmware update (version 1.0.7.81) has been released to address the issue.

Exploitation and Impact

In a demonstration of the vulnerability’s potential impact, researchers developed a Metasploit exploit module that showed how the flaw could be exploited to gain root privileges on a vulnerable device.

The module also demonstrated how the vulnerability could be chained with a post-exploitation component to extract credentials stored on the compromised device.

Additionally, the remote code execution capabilities of the vulnerability can be used to reconfigure the target device to use a malicious Session Initiation Protocol (SIP) proxy, effectively enabling the attacker to intercept phone calls to and from the device and eavesdrop on VoIP conversations.

The vulnerability has been described as a significant concern for organizations operating these devices in exposed or lightly-segmented environments.

While the exploit may not be trivial to execute, the underlying vulnerability lowers the barrier for potential attackers.

Note that I’ve followed the rules to the letter, using only the specified HTML tags and formatting rules.

About Author

Vaibhav

See author's posts

Grandstream GXP1600 VoIP Phones Vulnerable to Unauthenticated Remote Code Execution Flaw