Loading story…
Rapid7 disclosed CVE-2026-2329, a critical unauthenticated stack-based buffer overflow (CWE-121) in the Grandstream GXP1600 series VoIP phones that can be exploited for remote code execution (RCE) as root. The flaw is reachable via the phone’s web-based HTTP API in default configurations, specifically the endpoint /cgi-bin/api.values.get, and impacts all models sharing the common firmware image: GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630. Public scoring cited includes CVSS v4.0 9.3 (Critical) with network attack vector and no privileges or user interaction required.
Rapid7 demonstrated exploitability by developing a Metasploit exploit module (plus a post-exploitation module) showing unauthenticated compromise of a vulnerable device (e.g., GXP1630 on firmware 1.0.7.79) and subsequent credential collection (including local and SIP accounts). Rapid7 also highlighted operational risk beyond device takeover: with root access, an attacker could alter SIP configuration to route calls through attacker-controlled infrastructure, enabling covert call interception. Grandstream has released a firmware fix, version 1.0.7.81, to remediate the issue, and the disclosure is tracked via Grandstream PSIRT and Metasploit references.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
A pull request was opened to add a Nuclei template for safely detecting vulnerable Grandstream GXP1600 devices via the affected API endpoint. This expanded defender tooling beyond the Metasploit exploit and post-exploitation modules.
Public CVE tracking sources published CVE-2026-2329 as a high-severity issue affecting six Grandstream GXP1600 models, classifying it as CWE-121 and noting network-reachable unauthenticated exploitation. The entry linked to vendor and Rapid7 references, helping standardize public awareness of the bug.
Alongside its disclosure, Rapid7 released a Metasploit exploit module demonstrating root RCE and a post-exploitation module to extract stored secrets such as local and SIP credentials. The tooling also showed how compromised phones could be reconfigured to use attacker-controlled SIP infrastructure for call interception.
Rapid7 published coordinated disclosure details for CVE-2026-2329, describing a critical unauthenticated stack-based buffer overflow in the /cgi-bin/api.values.get endpoint that enables root remote code execution on Grandstream GXP1600 phones. The disclosure credited Stephen Fewer and explained the root cause, affected models, and exploitability conditions.
After issuing the firmware update, Grandstream publicly disclosed the security issue through its PSIRT and release-note channels. This made the existence of the flaw and the availability of a fix broadly known.
Grandstream released firmware version 1.0.7.81 to remediate the vulnerability affecting GXP1600-series phones. Reports place the patch release in early February 2026, with sources citing February 2 or February 3.
Rapid7 researcher Stephen Fewer reported the unauthenticated stack-based buffer overflow in Grandstream GXP1600-series VoIP phones to Grandstream in early January 2026, beginning coordinated disclosure. Some reporting indicates follow-up contact attempts were made later in January.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
10 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcegithub.com
Open sourcecybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourcecvefeed.io
Open sourcedarkreading.com
Open sourcerapid7.com
Open sourcerapid7.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rapid7 disclosed **`CVE-2026-0826`**, a critical unauthenticated stack-based buffer overflow in HP Poly **VVX** and **Trio** VoIP phones that can allow remote code execution as **root**. The flaw resides in SDP parsing of ICE candidate attributes within the `polyapp` binary when the non-default **ICE** feature is enabled. Rapid7 demonstrated exploitation against a Poly VVX 450 running firmware `6.4.7.4477`, showing that existing mitigations were not sufficient in practice: **NX** was enabled, but the binary lacked **PIE**, and some shared libraries loaded at fixed addresses despite nominal **ASLR**, enabling a **ROP**-based exploit. HP said the issue affects all VVX models and several Trio conference phones, assigned it a **CVSSv4 9.2**, and released patched firmware while advising administrators to disable ICE if it is not required. The disclosure also warned that compromised enterprise desk phones can become stealthy footholds for persistence, lateral movement, traffic interception, and call manipulation, while exposing sensitive audio from executive offices and conference rooms. Rapid7 said the risk extends beyond traditional espionage because control of trusted business phones could support **AI-enabled impersonation**, including vishing and deepfake-assisted fraud, underscoring that VoIP endpoints should be treated as fully networked computers rather than benign office appliances.
Jun 29, 2026
HP disclosed **CVE-2026-0826**, a critical buffer overflow vulnerability in certain **Poly Voice** devices running on Linux that can lead to remote code execution and possible remote control of affected systems. The flaw carries a **CVSS v4.0 score of 9.2** and is remotely exploitable with low attack complexity, no privileges, and no user interaction, but only in deployments where an administrator has enabled **Interactive Connectivity Establishment (ICE)**. According to HP bulletin **`HPSBPY04083`**, affected products include **VVX**, **Trio 8300**, **Trio 8500**, and **Trio 8800** devices. HP urged customers to update to the latest **UCS firmware** through **HP Poly Lens** and advised disabling ICE connectivity where it is not needed. The issue was reported by **Stephen Fewer of Rapid7** and is classified under **`CWE-121`**.
Jun 29, 2026
Cisco released fixes for a **critical remote code execution** vulnerability in Unified Communications and *Webex Calling Dedicated Instance*, tracked as **CVE-2026-20045**, after it was **actively exploited as a zero-day**. The issue stems from **improper validation of user-supplied input in HTTP requests** to the web-based management interface; successful exploitation can provide **user-level OS access** and enable **privilege escalation to root**. Affected products include **Cisco Unified Communications Manager (Unified CM)**, **Unified CM Session Management Edition (SME)**, **Unified CM IM & Presence**, **Cisco Unity Connection**, and **Webex Calling Dedicated Instance**; Cisco provided version-specific remediations including fixed releases and `.cop` patch files (e.g., `ciscocm.V14SU4a_CSCwr21851_remote_code_v1.cop.sha512`). CISA added **CVE-2026-20045** to its **Known Exploited Vulnerabilities (KEV) Catalog**, citing evidence of active exploitation and highlighting code injection flaws as a common attack vector with significant risk to the federal enterprise. Under **Binding Operational Directive (BOD) 22-01**, Federal Civilian Executive Branch agencies are required to remediate KEV-listed vulnerabilities by the specified due date, and CISA urged all organizations to similarly prioritize patching to reduce exposure to ongoing attacks.
Jul 23, 2026