CVE-2025-28170

Published: Jul 29, 2025Modified: Jul 5, 2026

7.6

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Exploitability: 2.8 / Impact: 4.7

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Grandstream Networks GXP1628 <=1.0.4.130 is vulnerable to Incorrect Access Control. The device is configured with directory listing enabled, allowing unauthorized access to sensitive directories and files.

Affected (1)

Products: Grandstream: Gxp1628 Firmware

Grandstream

1 product

Gxp1628 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Grandstream Gxp1628 Firmware	Up to 1.0.4.130

Running on/with	Platform Versions
Grandstream Gxp1628	All versions

Related CWEs

CWE-548

Exposure of Information Through Directory Listing

A directory listing is inappropriately exposed, yielding potentially sensitive information to attackers.

References (1)

https://gist.github.com/Exek1el/928ea6fd06d3b48c1c91cfdc30317d8d

Source: cve@mitre.org

ExploitThird Party Advisory

Timeline

No history available yet.