Grandstream GXP1600 CVE-2026-2329

Detects likely exploitation attempts for CVE-2026-2329 by matching requests to /cgi-bin/api.values.get where the first identifier in the request= parameter exceeds the 64-byte stack buffer described by Rapid7.