CVE-2026-2329Disclosure(grandstream / gxp1610)

CRITICALCVSS 9.8 · CRITICAL

Exploitation observed; activity peaked at 23 mentions and remains active

Immediate actions

Patch grandstream gxp1610 systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote code execution (RCE) with root privileges on a target device. The vulnerability affects all six device models in the series: GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630.

grandstream CVEs Back to dashboard

9.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/rapid7/metasploit-framework/pull/20983

Vendor / third-party advisories

Other references

https://firmware.grandstream.com/Release_Note_GXP16xx_1.0.7.81.pdf

Weakness type (CWE)

CWE-121

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

gxp1610
gxp1610_firmware
gxp1615
gxp1615_firmware

Threat summary

Active exploitation appears in 6 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
88 mentions across 16 observed days

What's happening

Active exploitation reported across 6 signals
Exploit tool or code specified in 9 signals
PoC mentioned or linked in 14 signals
Patch or workaround mentioned in 35 signals
Technical details provided in 75 signals
Disclosure: 38 classified signals
General: 9 classified signals
Peaked 14d ago at 23 mentions (2026-02-19); latest day: 1
88 total mentions across 16 days

Affected systems

Vendors

grandstream

Products

gxp1610gxp1610_firmwaregxp1615gxp1615_firmwaregxp1620gxp1620_firmwaregxp1625gxp1625_firmwaregxp1628gxp1628_firmware

1 version affected across 12 products

Deep dive

Activity timeline88 mentions / 16d

Signal classification6 categories

Disclosure

3843.2%

Patch

2427.3%

General

910.2%

Exploit

78.0%

Active Exploitation

55.7%

PoC

55.7%

Referenced assets71 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-18	22	Active Exploitation2Disclosure13Exploit2Patch5
2026-02-19	23	Active Exploitation2Disclosure14General1Patch4PoC2
2026-02-20	9	Disclosure5General2Patch1PoC1
2026-02-22	2	Disclosure1General1
2026-02-23	13	Disclosure1Exploit1General2Patch8PoC1
2026-02-24	2	Exploit1Patch1
2026-02-25	7	Disclosure4Patch2PoC1
2026-02-26	1	Exploit1
2026-02-28	1	Exploit1
2026-03-02	1	Active Exploitation1
2026-03-04	2	General1Patch1
2026-03-24	1	Patch1
2026-04-07	1	Exploit1
2026-04-15	1	General1
2026-04-18	1	Patch1
2026-09-10	1	General1

Full discourse20 posts

Rapid7@rapid7232d
Disclosure
🚨 In conducting 0 day research against #Grandstream GXP1600 VoIP phones, Rapid7 Labs discovered CVE-2026-2329. The unauthenticated stack-based buffer overflow vuln ultimately allows an attacker to intercept phone calls and eavesdrop on audio. Read on: https://r-7.co/4tIzope https://t.co/gblzGdBIZz
Post summary
Rapid7 Labs disclosed CVE-2026-2329, a stack‑based buffer overflow in Grandstream GXP1600 VoIP phones that allows unauthenticated attackers to intercept calls and eavesdrop.
34321977816.1K
123.6K followersView on X
Stephen Fewer@stephenfewer232d
Exploit
Today we are disclosing CVE-2026-2329, a critical unauthenticated stack-based buffer overflow vulnerability affecting the Grandstream GXP1600 series of VoIP phones. Check out our disclosure over on the @rapid7 blog, including technical details for unauthenticated RCE, and accompanying @metasploit modules: https://r-7.co/4tIzope
Post summary
Rapid7 discloses CVE‑2026‑2329, a critical unauthenticated stack‑based buffer overflow in Grandstream GXP1600 VoIP phones, and shares a functional Metasploit module enabling remote code execution.
04801737112.1K
9.6K followersView on X
The Hacker News@TheHackersNews232d
Disclosure
Researchers found a stack overflow in Grandstream GXP1600 phones (CVE-2026-2329, 9.3 CVSS). A crafted API request can overwrite memory and run code remotely—no login required. Post-exploitation includes credential theft and VoIP call interception via rogue SIP proxy. 🔗 Read → https://thehackernews.com/2026/02/grandstream-gxp1600-voip-phones-exposed.html
Post summary
Researchers disclosed a stack overflow in Grandstream GXP1600 phones (CVE‑2026‑2329) that allows unauthenticated remote code execution, facilitating credential theft and SIP call interception.
420169157.8K
1.0M followersView on X
Nicolas Krassas@Dinosn232d
Patch
CVE-2026-2329: Critical Unauthenticated Stack Buffer Overflow in Grandstream GXP1600 VoIP Phones https://www.rapid7.com/blog/post/ve-cve-2026-2329-critical-unauthenticated-stack-buffer-overflow-in-grandstream-gxp1600-voip-phones-fixed/
Post summary
Rapid7 reports CVE-2026-2329 as a critical unauthenticated stack buffer overflow in Grandstream GXP1600 VoIP phones, noting that a fix has been released.
0401441.6K
150.9K followersView on X
Hackviser@hackviserr184d
Exploit
Ready to exploit a stack overflow and pop a root shell on a VoIP phone? ⚡️🚨 Just added to Hackviser Labs: Grandstream GXP1600 Unauthenticated Remote Code Execution (CVE-2026-2329)🔥 This critical unauthenticated buffer overflow lets attackers gain root access on Grandstream's widely-deployed VoIP phones — and we've already got the environment ready for you to exploit! Perfect for security professionals and enthusiasts looking to understand and practice with real-world vulnerabilities. Join Hackviser to start the lab now 🚀
Post summary
The post announces availability of an exploitable environment for CVE‑2026‑2329, indicating a ready-to-use exploit rather than just a disclosure, with no mention of patches or active wild attacks.
030102458
4.4K followersView on X
Anonymous. Saints@Saints16294225226d
Patch
2026: Grandstream GXP1600 phones CVE-2026-2329 — unauthenticated RCE allows call interception & eavesdropping. #OpChildSafe alert: Homes, schools, clinics using VoIP? Update firmware & segment networks now. No one spies on children. 🕊️🔥 #CyberSecurity #VoIP https://t.co/d7Fzr3mJ5n
Post summary
The tweet warns of an unauthenticated RCE in Grandstream GXP1600 phones (CVE‑2026‑2329) that enables call interception, urging users to update firmware and segment networks to mitigate the risk.
15090353
3.0K followersView on X
The Cyber Security Hub™@TheCyberSecHub231d
Disclosure
Bug in widely used VoIP phones allows stealthy network footholds, call interception (CVE-2026-2329) https://www.helpnetsecurity.com/2026/02/19/grandstream-voip-phones-vulnerability-cve-2026-2329/?utm_source=dlvr.it&utm_medium=twitter
Post summary
The post announces CVE‑2026‑2329 in Grandstream VoIP phones, noting that it can create stealthy network footholds and intercept calls, but provides no exploit code, patch info, or detailed technical data.
04060518
192.6K followersView on X
Help Net Security@helpnetsecurity231d
Disclosure
Bug in widely used VoIP phones allows stealthy network footholds, call interception (CVE-2026-2329) - https://www.helpnetsecurity.com/2026/02/19/grandstream-voip-phones-vulnerability-cve-2026-2329/ - @rapid7 @stephenfewer @fulmetalpackets @GrandstreamNet #IPphones #SecurityUpdate #SMBs #VoIP #Vulnerability #Cybersecurity #CybersecurityNews
Post summary
The post announces CVE-2026-2329, a vulnerability in widely used VoIP phones that enables stealthy network footholds and call interception, but provides no PoC, exploit details, patch information, or evidence of active exploitation.
03061390
60.0K followersView on X
trawmatik@MrTrawmatik218d
General
@lUkraineLibre О це саме в цій моделі недавно знайшли вразливість. CVE-2026-2329 Тому всі кинулись продавати?))))
Post summary
The post simply notes that a new vulnerability (CVE-2026-2329) was found in a model, without providing any technical details, exploit information, or mitigation guidance.
20041335
7 followersView on X
Blue Team News@blueteamsec1197d
Patch
CVE-2026-2329: Critical Unauthenticated Stack Buffer Overflow in Grandstream GXP1600 VoIP Phones (FIXED) http://dlvr.it/TRgsJd #cyber #threathunting #infosec
Post summary
The Grandstream GXP1600 VoIP phones have a critical unauthenticated stack buffer overflow (CVE-2026-2329) that has already been patched; a fix is available.
01050553
55.2K followersView on X
Una al día@unaaldia228d
Disclosure
CVE-2026-2329: Vulnerabilidad crítica en teléfonos Grandstream permite interceptar llamadas https://unaaldia.hispasec.com/2026/02/cve-2026-2329-vulnerabilidad-critica-en-telefonos-grandstream-permite-interceptar-llamadas.html
Post summary
A critical vulnerability (CVE-2026-2329) in Grandstream phones enables attackers to intercept calls, as reported by Hispasec.
02030387
17.3K followersView on X
SC Media@SCMagazine227d
Patch
Critical RCE (CVE-2026-2329, CVSS 9.3) in Grandstream GXP1600 VoIP phones could enable call eavesdropping, @rapid7 reported. Patch to firmware 1.0.7.81 immediately. #cybersecurity #infosec #CISO #ITsecurity https://bit.ly/3MncenO
Post summary
Rapid7 reported a critical RCE in Grandstream GXP1600 VoIP phones (CVE-2026-2329, CVSS 9.3) that could enable call eavesdropping, and urged immediate patching to firmware 1.0.7.81.
010301.4K
119.3K followersView on X
Gray Hats@the_yellow_fall230d
PoC
Rapid7 publicly discloses a critical flaw and PoC (CVE-2026-2329) for Grandstream GXP1600 VoIP phones allowing remote root access. Patch now. #Grandstream #ZeroDay #CVE20262329 #VoIPSecurity #CyberSecurity #InfoSec #Rapid7 #PoC https://securityonline.info/poc-publicly-disclosed-critical-grandstream-voip-flaw-cvss-9-3-grants-stealthy-root-access/
Post summary
Rapid7 released a PoC for CVE-2026-2329 on Grandstream GXP1600 phones, granting remote root access, and a patch has been issued.
02020301
10.3K followersView on X
SC Media@SCMagazine224d
Patch
Critical RCE (CVE-2026-2329, CVSS 9.3) in Grandstream GXP1600 VoIP phones could enable call eavesdropping, @rapid7 reported. Patch to firmware 1.0.7.81 immediately. #cybersecurity #infosec #CISO #ITsecurity https://bit.ly/3MncenO
Post summary
Rapid7 reported a critical RCE in Grandstream GXP1600 VoIP phones, with a firmware patch 1.0.7.81 available to mitigate call eavesdropping risk.
00120382
119.3K followersView on X
Misbar | مسبار@MisbarSec225d
PoC
🚨 ثغرة RCE في هواتف Grandstream GXP1600 تم إصدار PoC exploit لثغرة RCE حرجة في هواتف Grandstream GXP1600 series. الثغرة، CVE-2026-2329، من نوع zero-day وتؤثر على الأجهزة بدون الحاجة لتصديق. هذا يعني إمكانية اختراق الأجهزة عن بعد. 💡 خطوات الحماية: - التأكد من تحديث firmware الهواتف لآخر إصدار. - مراجعة إعدادات الشبكة لتقييد الوصول غير المصرح به. - مراقبة حركة المرور للأنشطة المشبوهة. 🔗 https://cybersecuritynews.com/grandstream-gxp1600-voip-phones-rce-vulnerability/ #الأمن_السيبراني #Grandstream #VoIP #Vulnerability #ZeroDay
Post summary
A PoC exploit for CVE-2026-2329, a zero‑day RCE in Grandstream GXP1600 phones, has been released, and users are urged to update firmware and tighten network settings.
0002088
53 followersView on X
CCB Alert@CCBalert230d
Disclosure
Warning: Critical Stack-Based Buffer Overflow in #Grandstream GXP1600 VoIP phones. CVE-2026-2329 CVSS: 9.3. This vulnerability can lead to unauthenticated remote code execution #RCE and silent call eavesdropping! #Patch #Patch #Patch More info: https://www.rapid7.com/blog/post/ve-cve-2026-2329-critical-unauthenticated-stack-buffer-overflow-in-grandstream-gxp1600-voip-phones-fixed/
Post summary
A critical stack-based buffer overflow (CVE‑2026‑2329) in Grandstream GXP1600 VoIP phones is disclosed with a high CVSS score and available patch, enabling unauthenticated remote code execution and call eavesdropping.
00011207
7.2K followersView on X
Cyberwarzone.com - by Threat Intelligence Lab@Cyberwarzonecom231d
Disclosure
Critical RCE in Grandstream GXP1600 VoIP phones enables silent eavesdropping (CVE-2026-2329) - https://cyberwarzone.com/2026/02/18/critical-rce-in-grandstream-gxp1600-voip-phones-enables-silent-eavesdropping-cve-2026-2329/ https://t.co/lkUc0YEsXl
Post summary
The article announces a critical remote code execution vulnerability in Grandstream GXP1600 VoIP phones that allows silent eavesdropping.
0001183
6.4K followersView on X
ThreatSynop@ThreatSynop222d
Exploit
🚨 Metasploit Update Drops Linux RC4 Evasion + New RCE Exploits for Ollama, BeyondTrust, and VoIP Rapid7’s Feb 27 Metasploit release adds new exploit modules for high-severity RCE issues (including Ollama CVE-2024-37032, BeyondTrust PRA/RS CVE-2026-1731, and Grandstream GXP1600 CVE-2026-2329) plus a Linux ARM64 “RC4 packer” evasion module that executes payloads in-memory. This matters because it operationalizes fresh vulnerabilities into turnkey exploitation and introduces stealthier Linux tradecraft that can raise defender detection/response costs. 🎯 Target: Global / Enterprise & AI infrastructure #️⃣ Category: #Vulnerability #BlueTeam #AI_Threats 🔗 URL: https://cybersecuritynews.com/metasploit-adds-new-modules-targeting-linux-rc4/
Post summary
Rapid7’s February 27 Metasploit release introduces new exploit modules for several high‑severity RCE CVEs—including Ollama CVE‑2024‑37032, BeyondTrust CVE‑2026‑1731, and Grandstream CVE‑2026‑2329—alongside a Linux ARM64 RC4 evasion technique that executes payloads in memory.
00010105
227 followersView on X
Enable Security@enablesecurity224d
Exploit
3/ Rapid7 dropped a full chain on Grandstream GXP1600 phones: unauthenticated stack overflow to root (CVE-2026-2329, CVSS 9.3). They built Metasploit modules for credential extraction and silent SIP call interception. No stack canary, non-PIE binary.
Post summary
Rapid7 released a full chain for CVE-2026-2329, including Metasploit modules for credential extraction and SIP call interception, confirming a stack overflow that allows root escalation on Grandstream GXP1600 phones.
1000074
345 followersView on X
kantan.news@KantanNewsX226d
Exploit
Grandstream GXP1600 serisi VoIP telefonlarda root yetkisi sağlayan kritik bir RCE zafiyeti (CVE-2026-2329) tespit edildi. CVSS skoru 9.3 olan açık için Metasploit exploiti yayınlandı. Çağrıların dinlenmemesi için acilen güncelleyin! Haberin detayı: https://kantan.news/x_article.php?slug=grandstream-gxp1600-voip-telefonlarnda-kritik-rce-zafiyeti-poc-exploit-yaynland
Post summary
A critical RCE vulnerability (CVE-2026-2329) in Grandstream GXP1600 VoIP phones has been identified with a CVSS score of 9.3, and a Metasploit exploit has been released, urging users to update urgently.
00010174
793 followersView on X

CPE platform detail12 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

12 of 12 entries

Part	Vendor	Product	Version	Target SW	Target HW
HW	grandstream	gxp1610	-	-	-
OS	grandstream	gxp1610_firmware	-	-	-
HW	grandstream	gxp1615	-	-	-
OS	grandstream	gxp1615_firmware	-	-	-
HW	grandstream	gxp1620	-	-	-
OS	grandstream	gxp1620_firmware	-	-	-
HW	grandstream	gxp1625	-	-	-
OS	grandstream	gxp1625_firmware	-	-	-
HW	grandstream	gxp1628	-	-	-
OS	grandstream	gxp1628_firmware	-	-	-
HW	grandstream	gxp1630	-	-	-
OS	grandstream	gxp1630_firmware	-	-	-

Explore more

Back to dashboard grandstream CVEs gxp1610 vulnerabilities

What researchers are saying

CVE-2026-2329

Stephen Fewer[verified]@stephenfewerExploit

Rapid7 discloses CVE‑2026‑2329, a critical unauthenticated stack‑based buffer overflow in Grandstream GXP1600 VoIP phones, and shares a functional Metasploit module enabling remote code execution.

Nicolas Krassas[verified]@DinosnPatch

Rapid7 reports CVE-2026-2329 as a critical unauthenticated stack buffer overflow in Grandstream GXP1600 VoIP phones, noting that a fix has been released.

The Cyber Security Hub™[verified]@TheCyberSecHubDisclosure

The post announces CVE‑2026‑2329 in Grandstream VoIP phones, noting that it can create stealthy network footholds and intercept calls, but provides no exploit code, patch info, or detailed technical data.

Blue Team News[verified]@blueteamsec1Patch

The Grandstream GXP1600 VoIP phones have a critical unauthenticated stack buffer overflow (CVE-2026-2329) that has already been patched; a fix is available.

Misbar | مسبار[verified]@MisbarSecPoC

A PoC exploit for CVE-2026-2329, a zero‑day RCE in Grandstream GXP1600 phones, has been released, and users are urged to update firmware and tighten network settings.

ThreatSynop[verified]@ThreatSynopExploit

Rapid7’s February 27 Metasploit release introduces new exploit modules for several high‑severity RCE CVEs—including Ollama CVE‑2024‑37032, BeyondTrust CVE‑2026‑1731, and Grandstream CVE‑2026‑2329—alongside a Linux ARM64 RC4 evasion technique that executes payloads in memory.

kantan.news[verified]@KantanNewsXExploit

A critical RCE vulnerability (CVE-2026-2329) in Grandstream GXP1600 VoIP phones has been identified with a CVSS score of 9.3, and a Metasploit exploit has been released, urging users to update urgently.

Rapid7@rapid7Disclosure

Rapid7 Labs disclosed CVE-2026-2329, a stack‑based buffer overflow in Grandstream GXP1600 VoIP phones that allows unauthenticated attackers to intercept calls and eavesdrop.