Remote Information Disclosure Vulnerability in Grandstream UCM6510 Product
CVE-2025-28171

6.5MEDIUM

Key Information:

Vendor

Grandstream

Status
UCM6510
Vendor
CVE Published:
29 July 2025

What is CVE-2025-28171?

An issue has been identified in the Grandstream UCM6510, where a remote attacker can exploit the Login function at the /cgi and /webrtccgi endpoints to gain unauthorized access to sensitive information. This vulnerability affects versions up to and including v.1.0.20.52, putting users at risk of exposure to confidential data. It is crucial for organizations using the affected product to implement security measures and monitor their systems for possible exploitation.

References

http://grandstream.com
http://ucm65xx.com
https://gist.github.com/Exek1el/a1fe4288f0df0a47068d61857...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-28171 : Remote Information Disclosure Vulnerability in Grandstream UCM6510 Product