CVE-2026-2329

The vulnerability (CWE-121) consists of a stack buffer overflow via a malformed HTTP request to the /cgi-bin/api.values.get endpoint. The request handling process does not properly verify the length of input data, allowing an attacker to overwrite data on the stack and seize control of program execution flow. The attack requires no authentication or user interaction, and can be conducted remotely over the network.

An attacker can gain full control of the device by executing arbitrary code with root privileges (RCE), granting unlimited access to VoIP phone functions, call interception, and potential use of the device as an entry point into the internal network.

Firmware must be immediately updated to version 1.0.7.81 or higher, available from the manufacturer (Release Note GXP16xx 1.0.7.81). Until the update is applied, it is recommended to restrict access to the HTTP interface of devices exclusively to trusted networks or VLAN segments and implement firewall rules blocking unauthorized access to administrative ports.

All six models in the GXP1600 series: GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630 (firmware in all vulnerable versions — details in manufacturer's release notes). The patched firmware version is 1.0.7.81 or newer.