Threat Investigation
Request a demo

CVE-2026-2329

Critical

Description

An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote code execution (RCE) with root privileges on a target device. The vulnerability affects all six device models in the series: GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630.

SeverityCritical
CVSS9.8
Exploit probability—
ProductGrandstream Gxp1610 Firmware
PublishedFeb 18, 2026
First seenFeb 18, 2026
Weakness typeCWE-121CWE-121

How to fix

Update
  • grandstream gxp1610_firmware1.0.7.81 or later
  • grandstream gxp1615_firmware1.0.7.81 or later
  • grandstream gxp1620_firmware1.0.7.81 or later
  • grandstream gxp1625_firmware1.0.7.81 or later
  • grandstream gxp1628_firmware1.0.7.81 or later
  • grandstream gxp1630_firmware1.0.7.81 or later
Vendor advisories

Affected products

ProductAffected versionsFixed in
grandstream gxp1610_firmwarev < 1.0.7.811.0.7.81
grandstream gxp1615_firmwarev < 1.0.7.811.0.7.81
grandstream gxp1620_firmwarev < 1.0.7.811.0.7.81
grandstream gxp1625_firmwarev < 1.0.7.811.0.7.81
grandstream gxp1628_firmwarev < 1.0.7.811.0.7.81
grandstream gxp1630_firmwarev < 1.0.7.811.0.7.81

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.