CVE-2026-2329 Hunt
This rule detects potential exploitation attempts against Grandstream GXP1600 series IP phones related to CVE-2026-2329. It specifically looks for HTTP requests to the '/cgi-bin/api.values.get' endpoint where the 'request' parameter in the URI query string has a length greater than or equal to 65 characters, which could indicate an attempt to trigger a buffer overflow or similar vulnerability.
Splunk (SPL)
