Grandstream GXP1600 CVE-2026-2329 Exploit Attempt
This rule detects attempts to exploit CVE-2026-2329, a critical unauthenticated stack buffer overflow vulnerability in Grandstream GXP1600 VoIP phones. The detection logic looks for HTTP requests to the vulnerable endpoint '/cgi-bin/api.values.get' and specifically for an oversized 'request' parameter where the first identifier before a colon is 65 characters or longer, indicating a likely buffer overflow attempt.
Splunk (SPL)
