Critical Zero-Day in Grandstream VoIP Phones Enables Unauthenticated Remote Code Execution A severe zero-day vulnerability (CVE-2026-2329) in Grandstream’s GXP1600 series VoIP phones allows unauthenticated remote code execution (RCE) with root privileges. The flaw, a stack-based buffer overflow (CWE-121), affects the web-based API service on TCP port 80, accessible in default configurations without authentication. All six models GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630 share the same vulnerable firmware (versions up to 1.0.7.79). With a CVSSv4 score of 9.3 (Critical), the vulnerability enables low-complexity attacks from the network, posing significant risks to organizations using these devices for sensitive voice communications. The issue stems from improper bounds checking in the `/cgi-bin/api.values.Get` endpoint, where a fixed 64-byte stack buffer (`small_buffer`) overflows when processing maliciously crafted HTTP POST requests. Exploitation corrupts adjacent stack memory, including the program counter (PC), allowing attackers to execute arbitrary code via return-oriented programming (ROP) chains. Security mitigations like RELRO, stack canaries, and PIE are absent, though the NX bit prevents direct stack execution. Grandstream released firmware version 1.0.7.81 on January 30, 2026, patching the flaw. Rapid7 developed Metasploit modules for exploitation, including a post-exploitation tool to extract SIP credentials, enabling attackers to intercept calls, conduct toll fraud, or impersonate users. Public proof-of-concept (PoC) code further increases the threat, particularly for exposed devices in finance, government, or small businesses. Discovered by researcher Stephen Fewer on January 6, 2026, the vulnerability underwent coordinated disclosure, with no reported wild exploitation to date. However, the trivial exploitability makes it attractive to opportunistic attackers and advanced persistent threats (APTs). Mitigation requires immediate firmware updates, network segmentation to isolate VoIP devices, and disabling web interfaces where possible.