Grandstream GXP1600 VoIP Phones Exposed to Unauthenticated Remote Code Execution

Summary

A critical vulnerability (CVE-2026-2329) has been discovered in Grandstream GXP1600 series VoIP phones, allowing unauthenticated remote code execution. The flaw is a stack-based buffer overflow and has a CVSS score of 9.3.

IFF Assessment

FOE

Unauthenticated remote code execution vulnerabilities are a significant risk to defenders.

Severity

9.3 Critical

Defender Context

This vulnerability allows attackers to remotely compromise VoIP phones, potentially leading to eavesdropping, denial of service, or further network intrusion. Defenders should immediately patch affected devices or implement compensating controls such as network segmentation and access controls to mitigate the risk. VoIP devices are frequently targeted due to their often overlooked security posture and direct connection to organizational networks.

Read Full Story →