VoIP phone vulnerability can be used to listen in on calls

Rapid7 has disclosed CVE-2026-2329, a critical vulnerability in the Grandstream GXP1600 series of VoIP phones. The flaw is a classic stack-based buffer overflow and can be triggered against exposed devices or from other machines on the same network. An unauthenticated attacker can gain root access, change SIP settings and route calls through infrastructure they control. The phone keeps working normally without crashing or alerting the user, while conversations are relayed through the attacker's system. VoIP phones are frequently overlooked in security programmes, which makes them attractive in lightly segmented environments.

What this means for your organisation

This is not an availability problem, it is a confidentiality problem. Calls covering negotiations, personnel matters, patients or clients can be intercepted without anyone noticing. For organisations bound by confidentiality obligations or engaged in sensitive negotiations, that carries both reputational and legal consequences. The typical finding in such environments is that the phones sit on the same network as everything else and have not been updated since installation.

Berigo recommends

• Establish which IP phones you have, what firmware they run, and whether any are reachable from the internet.
• Place phones and other network appliances in their own segment, separated from clients and servers.
• Put firmware updates for phones into the regular maintenance plan rather than treating it as one-off work.
• Assess which conversations genuinely require confidentiality, and whether they should run over channels you control better.

Source

• rapid7.com