← Database

CVE-2026-2329

CRITICAL CVSS: 9.8 Published: 2026-02-18 Modified: 2026-06-17

Description

An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote code execution (RCE) with root privileges on a target device. The vulnerability affects all six device models in the series: GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630.

Affected Platforms

Grandstream Gxp1630Grandstream Gxp1615Grandstream Gxp1610 FirmwareGrandstream Gxp1620Grandstream Gxp1620 FirmwareGrandstream Gxp1625Grandstream Gxp1615 FirmwareGrandstream Gxp1628Grandstream Gxp1610Grandstream Gxp1628 Firmware

Weakness Type

CWE-121

References