Incorrect Access Control in Grandstream GXP1628 by Grandstream Networks
CVE-2025-28170

7.6HIGH

Key Information:

Vendor

Grandstream Networks

Status
GXP1628
Vendor
CVE Published:
29 July 2025

What is CVE-2025-28170?

The Grandstream GXP1628 phone is affected by a vulnerability that allows incorrect access control due to directory listing being enabled. This configuration flaw permits unauthorized individuals to access sensitive directories and files, potentially compromising user privacy and device security. Users of the affected GXP1628 models should take immediate action to disable directory listing and review their device security settings to mitigate risks associated with this vulnerability.

References

http://grandstream.com
https://gist.github.com/Exek1el/928ea6fd06d3b48c1c91cfdc3...

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-28170 : Incorrect Access Control in Grandstream GXP1628 by Grandstream Networks