PoC Exploit Released for Grandstream GXP1600 VoIP Phones RCE Vulnerability

A critical zero-day vulnerability, tracked as CVE-2026-2329, is affecting Grandstream’s GXP1600 series VoIP desk phones.

The issue is an unauthenticated stack-based buffer overflow that can be exploited remotely to achieve root-level remote code execution (RCE) on a vulnerable device.

Because the phones share a common firmware image across the series, all six models are impacted: GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630.

Rapid7 rates the flaw at CVSS v4.0 9.3 (Critical) and maps it to CWE-121 (stack-based buffer overflow).

Grandstream GXP1600 VoIP Phones RCE Vulnerability

The vulnerable component is the phone’s web service/API, which is accessible by default over HTTP (port 80).

Rapid7’s analysis highlights the API endpoint /cgi-bin/api.values.get, where an attacker-controlled request parameter is processed into a small 64-byte stack buffer without adequate bounds checking, enabling an overflow when the input is too long.

In exploitation notes, Rapid7 observed that modern mitigations are incomplete:

Mitigation	Status	Security Impact
NX (No-Execute)	Enabled	Prevents direct shellcode execution on the stack.
Stack Canaries	Absent	No protection against stack buffer overflows.
PIE (Position Independent Executable)	Not Enabled	Fixed memory layout makes ROP exploitation more reliable.

A public proof-of-concept has been implemented as Metasploit modules, including an exploit that demonstrates unauthenticated root RCE.

A post-exploitation module that can extract stored secrets such as local and SIP account credentials from a compromised phone.

Rapid7 also notes that once an attacker has code execution, they may be able to reconfigure SIP settings (for example, pointing a device at a malicious SIP proxy) to enable call interception in environments where the SIP infrastructure allows it.

Grandstream has released firmware version 1.0.7.81 to address the issue, and organizations should prioritize upgrading any GXP16xx devices running earlier versions.

Grandstream’s GXP16xx release notes list firmware 1.0.7.81 (dated 01/30/2026) and state it “Fixed some security vulnerabilities,” indicating a security-focused update for the series.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.