GrandStream GXP1600 Unauthenticated Remote Code Execution

MetasploitMetasploit exploitExploitRubyexploit_linux/http/grandstream_gxp1600_unauth_rce

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Metasploit exploit module for CVE-2026-2329, an unauthenticated stack-based buffer overflow in Grandstream GXP1600 VoIP phones. The module sends a crafted POST request to /cgi-bin/api.values.get to achieve remote code execution with root privileges via a ROP chain that calls system().

Backdoor review

No backdoor observed in reviewed code

The reviewed Metasploit module source code implements a documented stack-based buffer overflow exploit for CVE-2026-2329 against Grandstream GXP1600 VoIP phones. The exploit sends a crafted POST request to /cgi-bin/api.values.get to achieve ROP-based code execution, delivering a user-chosen Metasploit payload. No concealed backdoor, unrelated remote access, credential theft, persistence, or deceptive payload targeting the operator was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagesruby
Target softwareGrandstream GXP1600 series firmware
Attack typesbuffer overflowremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module is a complete Metasploit exploit that actively triggers a buffer overflow and executes arbitrary code on the target. It includes a check method for vulnerability detection, but its primary purpose is exploitation via the exploit method, which constructs and sends a malicious payload.

modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:6modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:120-211

Requirements

  • Target must be a Grandstream GXP1600 series device (GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, GXP1630) running firmware version below 1.0.7.81.modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:106-112
  • The target's HTTP service must be reachable on the configured RPORT (default 80).modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:51

Observed behavior

  • Sends a POST request to /cgi-bin/api.values.get with a 'request' parameter containing a version ID to retrieve the firmware version.modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:123-129
  • Selects a firmware-version-specific ROP table containing addresses for system@plt, .data section, and ROP gadgets.modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:137modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:263-415
  • Constructs a ROP chain that overwrites the return address to execute a series of gadgets, ultimately calling system() with an attacker-supplied command (the Metasploit payload).modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:149-174
  • Uses a multi-stage buffer overflow technique (gen_buffer) to write null bytes by triggering the overflow multiple times via colon-delimited identifiers.modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:213-261
  • Sends the final exploit request containing the overflow buffer, ROP chain, and payload to trigger the vulnerability and execute the payload.modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:204-210
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
Stack-based buffer overflow via POST to /cgi-bin/api.values.get with colon-delimited request parameterThe module exploits CVE-2026-2329 by sending a crafted request that overflows a stack buffer, then uses a ROP chain to call system@plt with an attacker-supplied command.modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:19-23modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:149-174modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:204-210
Payload Delivery
User-selected Metasploit payload (default: cmd/linux/http/armle/meterpreter_reverse_tcp)The exploit delivers the payload.encoded value as the OS command executed by the ROP chain. The payload is chosen by the Metasploit user, not hardcoded.modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:49-50modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:193-198
Cleanup Behavior
Registers /tmp/core.gz and /core for cleanup via FileDropper mixinThe module registers files for cleanup after exploitation, which is standard Metasploit practice to remove artifacts on the target.modules/exploits/linux/http/grandstream_gxp1600_unauth_rce.rb:200-202
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the provided Metasploit module source code and metadata; the actual behavior of the exploit on a live target was not observed.
  • The module relies on external Metasploit framework mixins (HttpClient, FileDropper) and payloads whose source code is not included in the evidence.
  • The ROP gadget addresses are hardcoded for specific firmware versions; the module's effectiveness depends on the accuracy of these addresses.
  • Only the module source code was reviewed; Metasploit framework mixins, libraries, and external payloads are not expanded or analyzed.
  • Binary files were not inspected; the analysis scope covers only the readable selected text of the module.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1