CVE-2026-2329 VoIP Phone Vulnerability Hunt
This rule detects attempts to exploit CVE-2026-2329, a critical unauthenticated stack buffer overflow vulnerability in Grandstream GXP1600 series VoIP phones. The detection logic specifically looks for HTTP requests to the '/cgi-bin/api.values.get' endpoint, with a particular focus on the 'request' parameter within the query string. A request parameter with a length greater than or equal to 65 characters is indicative of a potential exploit attempt, as this length is likely to trigger the buffer overflow.
Splunk (SPL)
