CVE-2026-2329 is a critical flaw (CVSS 9.8) in the Grandstream GXP1600 series of VoIP phones. An unauthenticated stack based buffer overflow in an HTTP API endpoint lets a remote attacker run code as root. Grandstream fixed it in firmware 1.0.7.81, so upgrade every GXP1610, 1615, 1620, 1625, 1628 and 1630.
What's affected
All six models in the GXP1600 series are affected, because they share one firmware image: GXP1610, GXP1615, GXP1620, GXP1625, GXP1628 and GXP1630.
Rapid7, which found the flaw, says firmware version 1.0.7.81 fully remediates it and tells owners to run that version or above. Grandstream's release note for 1.0.7.81 is among the references in the record.
Rapid7 also says the vulnerable service is reachable in a default configuration. That means you do not need to have changed any setting for a phone to be exposed.
The vendor fix is the only remedy named in the sources. If you cannot update a phone right away, keep it off any network that untrusted users or the internet can reach.
How to check if you're exposed
Read the firmware version from each phone. The status page in the phone's web interface or the provisioning server shows it. Any GXP1600 below 1.0.7.81 needs the update.
At scale, ask your provisioning system or inventory for firmware versions by model, and check which phone VLANs can be reached from guest Wi-Fi, from other offices or from the internet.
The Rapid7 write-up refers to an accompanying Metasploit module. That does not change the fix, but it means defenders should not assume the flaw is hard to reproduce, so do not delay the update on that basis.
What to do now
- Inventory all GXP1600 phones and their firmware versions.
- Upgrade to firmware 1.0.7.81 or later through your provisioning system or each phone.
- Put phones on a voice VLAN that blocks inbound access from user networks and the internet.
- Make sure the phone web interface is not exposed through port forwards or a public address.
- Add the phones to your regular patch review, because desk phones are often forgotten.
Why it matters
The record classifies this as CWE-121 (Stack-based Buffer Overflow). An endpoint copies data into a fixed size area of memory on the stack without checking its size, so oversized input overwrites neighboring data. On a device with no memory protections that stop this, the result can be code execution. Rapid7's write-up describes it as running with root privileges and requiring no authentication.
Desk phones sit on the same network as laptops and servers, are rarely monitored, and run for years on the first firmware they get. That makes an unauthenticated root flaw valuable to an intruder as a quiet foothold. The record does not mark this CVE as a CISA Known Exploited Vulnerability. Rapid7 reports the discovery as its own research and says the vendor fixed it before disclosure.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which firmware version fixes CVE-2026-2329?
Version 1.0.7.81 or above, according to Rapid7 and Grandstream.
Do I need to enable anything for the phone to be exposed?
Rapid7 says the vulnerable service is accessible in a default configuration.
Sources
Last reviewed: 19 October 2026.
