vivianuba/grandstream-cve-2026-2329-analysisDefensive vulnerability-research project comparing vulnerable and patched Grandstream GXP1600 firmware for CVE-2026-2329, using SquashFS extraction, Ghidra reverse engineering, and ARM ELF tracing to document the vendor's remediation without weaponized ex
Defensive static-analysis project comparing Grandstream GXP1600 firmware 1.0.7.79 (vulnerable) and 1.0.7.81 (patched) to understand how the vendor remediated the request-parsing flaw associated with CVE-2026-2329.
This repository demonstrates a reproducible vulnerability-research workflow: preserving evidence, extracting embedded firmware, locating a target service, tracing an exposed API path, comparing vulnerable and patched implementations, and documenting the security impact without developing or weaponizing an exploit.
The analysis focused on the gs_web web-service binary and the /cgi-bin/api.values.get request path.
In firmware 1.0.7.79, static analysis identified a request-token parsing routine that uses a fixed local stack buffer (char acStack_68[68]) and copies request-controlled token data without an apparent upper-bound check before the write.
In firmware 1.0.7.81, the corresponding logic handles the request differently: it validates the request pointer, computes the request length, allocates a heap buffer sized to strlen(request) + 1, copies the request, and tokenizes the heap copy in place. This removes the fixed-size stack-buffer copy from the observed parsing path and is consistent with a remediation of the unsafe request handling.
For a quick recruiter- and analyst-friendly view of the finding, see Visual Patch Comparison. It contains three sanitized reconstructed diagrams covering:
The figures are explicitly labeled as reconstructions from recorded Ghidra analysis notes, not as screenshots of the Ghidra interface.
grandstream-cve-2026-2329-analysis/
├── README.md
├── LICENSE
├── .gitignore
├── docs/
│ ├── methodology.md
│ ├── findings.md
│ ├── visual-analysis.md
│ └── limitations.md
├── scripts/
│ ├── firmware_header_parser.py
│ └── extraction_reference.sh
├── hashes/
│ └── analyzed-files.sha256
└── screenshots/
└── README.md
The analyzed gs_web samples were tracked by SHA-256:
| Firmware | Role | SHA-256 |
|---|---|---|
| 1.0.7.79 | Vulnerable | 29dd365affbc9aaa3a1f8833edda8a41a03813692004f890830fc5bbdf324dab |
| 1.0.7.81 | Patched | 0cac4c54426db16d9f738a0c0b4715c600754f0f17430a6330ab8421310a8942 |
The vendor firmware images and extracted binaries are not included in this repository.
gs_web binary.api.values.get string and cross-references to locate related request-handling logic.See docs/methodology.md for additional detail.
This repository is intended for authorized defensive security research, vulnerability analysis, education, and reproducible technical documentation. It does not contain exploit code, weaponized payloads, vendor firmware, credentials, or instructions for unauthorized access.
The project is a static patch-comparison analysis. Dynamic exploitation, live-device testing, and exploitability validation were outside the completed scope. See docs/limitations.md.
Vivian Onyinye Uba
Cybersecurity | Threat Detection | Vulnerability Research | OT/ICS Security