CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Unauthenticated Remote Code Execution in Grandstream GXP1600 VoIP Phones

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

A critical vulnerability (CVE-2026-2329) in Grandstream GXP1600 series VoIP phones allows unauthenticated remote code execution (RCE) with root privileges. The flaw, a stack-based buffer overflow, stems from the device's web-based API service. The vulnerability affects multiple GXP1600 models and has been addressed in firmware version 1.0.7.81. Exploiting this flaw could enable attackers to extract stored credentials, intercept phone calls, and eavesdrop on VoIP conversations. The issue was discovered by Rapid7 researcher Stephen Fewer and demonstrated via a Metasploit exploit module.

Timeline

  1. 18.02.2026 18:35 1 articles · 6h ago

    Unauthenticated RCE in Grandstream GXP1600 VoIP Phones Disclosed

    A critical vulnerability (CVE-2026-2329) in Grandstream GXP1600 series VoIP phones allows unauthenticated remote code execution. The flaw, a stack-based buffer overflow, affects multiple models and has been addressed in firmware version 1.0.7.81. Exploiting this vulnerability can enable attackers to extract credentials and intercept VoIP calls.

    Show sources
    Open in new tab

Information Snippets