CVE-2026-2329 Hunt

Daniel Jeremiah@daniyyell

•updated Feb 25, 2026•0•41

This rule detects HTTP requests targeting the '/cgi-bin/api.values.get' endpoint with a 'request' parameter, which is indicative of exploitation attempts for CVE-2026-2329 in Grandstream GXP1600 series IP phones. This vulnerability allows for information disclosure.