CVE-2025-28170: High severity Grandstream GXP1628 vulnerability
Grandstream Networks GXP1628 <=1.0.4.130 is vulnerable to Incorrect Access Control. The device is configured with directory listing enabled, allowing unauthorized access to sensitive directories and files.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable directory listing on the GXP1628 to prevent unauthorized access to sensitive directories and files.
Grandstream Networks GXP1628 web interface/file manager directory listing = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2025-28170?
CVE-2025-28170 is considered a medium severity vulnerability due to incorrect access control allowing unauthorized directory listing.
How do I fix CVE-2025-28170?
To fix CVE-2025-28170, disable directory listing on the Grandstream GXP1628 device and ensure access controls are properly configured.
What versions of Grandstream GXP1628 are affected by CVE-2025-28170?
Grandstream GXP1628 versions up to and including 1.0.4.130 are affected by CVE-2025-28170.
What impact does CVE-2025-28170 have on device security?
CVE-2025-28170 allows unauthorized users to access sensitive directories and files, compromising the security of the device.
Is there a patch available for CVE-2025-28170?
As of now, there is no specific patch provided for CVE-2025-28170, but updating to a version that addresses access controls is recommended.