A critical vulnerability, CVE-2026-2329 (CVSS 9.3), has been discovered in Grandstream GXP1600 series VoIP phones, allowing unauthenticated attackers to gain root-level control.

Key Details

• Vulnerability Type: An unauthenticated stack-based buffer overflow.
• Root Cause: Improper bounds checking in the web management API endpoint /cgi-bin/api.values.get.
• Affected Models: All GXP1600 series models, including GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630.
• Attack Vector: An attacker sends a specially crafted HTTP request to the device’s default web API. No valid credentials or user interaction are required.

Critical Impacts

• Call Interception: Attackers can reconfigure the device to use a malicious SIP proxy, allowing them to silently eavesdrop on and record all incoming and outgoing calls.
• Stealthy Network Foothold: Once root access is achieved, the phone can serve as a persistent entry point into the internal network for further lateral movement.
• Credential Theft: Attackers can extract local user credentials and SIP account details stored on the device.
• Toll Fraud: Compromised devices can be used to make unauthorized calls, leading to significant financial costs for businesses.

Remediation

• Immediate Action: Update affected phones to firmware version 1.0.7.81 or later to patch the flaw.
• Network Security: Ensure VoIP management interfaces are not directly exposed to the internet and are restricted to trusted internal segments.
• Technical Advisory: Detailed findings and a Metasploit module for testing are available via the Rapid7 technical report.