CVE-2026-2329: exploitation status and patch state
CVE-2026-2329 · CVSS 9.8 CRITICAL · EPSS 40%
An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote code execution (RCE) with root privileges on a target device. The vulnerability affects all six device models in the series: GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630.
Is CVE-2026-2329 exploited?
Not in the CISA KEV catalog.
EPSS puts exploitation in the next 30 days at 40%.
Public exploit code: packaged in a public tool.
Which products and versions are affected?
No affected package list recorded here yet.
Is there a patch?
No patch identifier recorded here yet.
What PlainSec published about CVE-2026-2329
PlainSec has not published a story about this CVE.