AI description
Automated description summarized from trusted sources.
CVE-2026-2329 is an unauthenticated stack-based buffer overflow vulnerability affecting the HTTP API endpoint `/cgi-bin/api.values.get` in Grandstream GXP1600 series VoIP phones. This flaw, categorized as CWE-121, impacts several models including GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630. The vulnerability allows a remote attacker to send specially crafted HTTP requests to the specified endpoint without needing authentication or user interaction. The issue stems from the device's web-based API service failing to perform a length check when appending data to a 64-byte buffer on the stack. This oversight enables an attacker to overflow the buffer, corrupting adjacent stack memory and leading to unauthenticated remote code execution with root privileges on the vulnerable device.
- Description
- An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote code execution (RCE) with root privileges on a target device. The vulnerability affects all six device models in the series: GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630.
- Source
- cve@rapid7.com
- NVD status
- Analyzed
- Products
- gxp1610_firmware, gxp1615_firmware, gxp1620_firmware, gxp1625_firmware, gxp1628_firmware, gxp1630_firmware
CVSS 4.0
- Type
- Secondary
- Base score
- 9.3
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- CRITICAL
CVSS 3.1
- Type
- Primary
- Base score
- 9.8
- Impact score
- 5.9
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity
- CRITICAL
- cve@rapid7.com
- CWE-121
- Hype score
- Not currently trending
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:grandstream:gxp1610_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "99246F81-B826-4D2F-9A82-629E64BF95EE",
"versionEndExcluding": "1.0.7.81",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:grandstream:gxp1610:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D92122D2-AD92-4EC3-81C3-CC58C3E3C287",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:grandstream:gxp1615_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A3D913E1-E682-454A-B6A9-9D8815E692B5",
"versionEndExcluding": "1.0.7.81",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:grandstream:gxp1615:-:*:*:*:*:*:*:*",
"matchCriteriaId": "713E836B-E61E-4E74-9026-F6470C9555F1",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:grandstream:gxp1620_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "03F5647A-F0A2-44D4-AE37-36D1B26A4DD0",
"versionEndExcluding": "1.0.7.81",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:grandstream:gxp1620:-:*:*:*:*:*:*:*",
"matchCriteriaId": "898FC5BB-6D88-4ED3-95FE-ACFA8D99AAD7",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:grandstream:gxp1625_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CABEDD99-B978-4818-9F7D-D53089E02BE0",
"versionEndExcluding": "1.0.7.81",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:grandstream:gxp1625:-:*:*:*:*:*:*:*",
"matchCriteriaId": "280FCCEF-196B-4BD4-B5C2-7DECC224A84C",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:grandstream:gxp1628_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "627DD526-9A9A-43BE-B060-3090FF33E741",
"versionEndExcluding": "1.0.7.81",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:grandstream:gxp1628:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8CDF28C0-982E-4DB8-8F3A-75103F2AF9A4",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:grandstream:gxp1630_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0F3398B8-0265-46D4-86C1-761B068424D9",
"versionEndExcluding": "1.0.7.81",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:grandstream:gxp1630:-:*:*:*:*:*:*:*",
"matchCriteriaId": "63FC9463-51FD-493D-B2FD-4E61EC6B98CA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
]