CVE-2025-28170: n/a
Grandstream Networks GXP1628 <=1.0.4.130 is vulnerable to Incorrect Access Control. The device is configured with directory listing enabled, allowing unauthorized access to sensitive directories and files.
AI Analysis
Technical Summary
CVE-2025-28170 describes an incorrect access control vulnerability in Grandstream Networks GXP1628 devices with firmware versions up to and including 1.0.4.130. The vulnerability arises because directory listing is enabled, exposing sensitive directories and files to unauthorized users. This exposure can lead to unauthorized information disclosure. The CVSS v3.1 base score is 7.6, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and low availability impact.
Potential Impact
Unauthorized users can access sensitive directories and files due to enabled directory listing, resulting in a high confidentiality impact. Integrity and availability impacts are low but present. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, it is recommended to disable directory listing on affected devices if possible or restrict access to the device management interface to trusted networks only.
CVE-2025-28170: n/a
Description
Grandstream Networks GXP1628 <=1.0.4.130 is vulnerable to Incorrect Access Control. The device is configured with directory listing enabled, allowing unauthorized access to sensitive directories and files.
CVSS v3.1
Score 7.6high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-28170 describes an incorrect access control vulnerability in Grandstream Networks GXP1628 devices with firmware versions up to and including 1.0.4.130. The vulnerability arises because directory listing is enabled, exposing sensitive directories and files to unauthorized users. This exposure can lead to unauthorized information disclosure. The CVSS v3.1 base score is 7.6, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and low availability impact.
Potential Impact
Unauthorized users can access sensitive directories and files due to enabled directory listing, resulting in a high confidentiality impact. Integrity and availability impacts are low but present. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, it is recommended to disable directory listing on affected devices if possible or restrict access to the device management interface to trusted networks only.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- mitre
- Date Reserved
- 2025-03-11T00:00:00.000Z
- State
- PUBLISHED
Threat ID: 6888feb4ad5a09ad008eef0d
Added to database: 07/29/2025, 17:02:44 UTC
Last enriched: 07/05/2026, 22:03:28 UTC
Last updated: 09/10/2026, 19:36:49 UTC
Views: 184
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.