Critical Grandstream VoIP Bug Highlights SMB Security Blind Spot
Summary
Punchy take: a single memory‑corruption bug just shoved voice infrastructure back up the risk list for every small and midsized organisation that treats phones like plumbing.
Rapid7 discovered CVE-2026-2329, a stack buffer‑overflow in Grandstream’s GXP1600 series that scores 9.3/10 on the CVSS scale and allows unauthenticated remote code execution with root privileges. The flaw is in the phone’s web API, which can be reachable in default configurations; Rapid7 published a Metasploit module to demonstrate unauthenticated RCE and post‑exploitation extraction of credentials. Grandstream issued a patch on 2 February 2026.
Key Points
- CVE-2026-2329: unauthenticated stack buffer overflow in Grandstream GXP1600 series, CVSS 9.3 — allows root RCE.
- Discovery and disclosure: Found by Rapid7 during zero‑day research; vendor patch released 2 Feb 2026; proof‑of‑concept exploit exists (Metasploit).
- Impact: attackers can extract plaintext SIP and local credentials, intercept calls, perform toll fraud, impersonate users and use phones as internal pivot points or C2 nodes.
- Why SMBs are at risk: flat networks, shared VLANs for phones and PCs, weak patch cycles and limited segmentation increase exposure.
- Mitigations: apply vendor firmware updates, segment VoIP on its own VLAN, enforce strong authentication, deploy TLS for SIP, limit management interface exposure and monitor for anomalous SIP traffic.
Why should I read this?
If you run a business phone system, don’t shrug this off. It’s not just about eavesdropping — a compromised handset can hand attackers credentials, call records and a foothold into your network. Read the details so you can patch, segment and lock down your VoIP kit before someone else makes the call for you.
Source
Source: https://www.darkreading.com/threat-intelligence/grandstream-bug-voip-security-blind-spot