Grandstream Exploitation Attempt

Daniel Jeremiah@daniyyell

•updated Feb 25, 2026•0•43

This rule detects attempts to exploit CVE-2026-2329, a critical unauthenticated stack buffer overflow vulnerability in Grandstream GXP1600 VoIP phones. The detection is based on requests to the '/cgi-bin/api.values.get' URI path, which is associated with the vulnerability.