Record status Published
Identifier year (not publication year) 2026
Source publication Feb 18, 2026
Source updated Feb 18, 2026
Imported by cveboard Oct 24, 2026
CNA source text (English) Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflow
An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote code execution (RCE) with root privileges on a target device. The vulnerability affects all six device models in the series: GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630.
Scoped product and version facts Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
GXP1610
Vendor Grandstream
Product GXP1610
Platforms Unknown
Default status unaffected
GXP1610 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0 affectedsemver Unavailable 1.0.7.80 None listed
GXP1615
Vendor Grandstream
Product GXP1615
Platforms Unknown
Default status unaffected
GXP1615 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0 affectedsemver Unavailable 1.0.7.80 None listed
GXP1620
Vendor Grandstream
Product GXP1620
Platforms Unknown
Default status unaffected
GXP1620 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0 affectedsemver Unavailable 1.0.7.80 None listed
GXP1625
Vendor Grandstream
Product GXP1625
Platforms Unknown
Default status unaffected
GXP1625 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0 affectedsemver Unavailable 1.0.7.80 None listed
GXP1628
Vendor Grandstream
Product GXP1628
Platforms Unknown
Default status unaffected
GXP1628 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0 affectedsemver Unavailable 1.0.7.80 None listed
GXP1630
Vendor Grandstream
Product GXP1630
Platforms Unknown
Default status unaffected
GXP1630 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0 affectedsemver Unavailable 1.0.7.80 None listed