CVE-2025-28172: Medium severity Grandstream UCM6510 vulnerability
Grandstream Networks UCM6510 v1.0.20.52 and before is vulnerable to Improper Restriction of Excessive Authentication Attempts. An attacker can perform an arbitrary number of authentication attempts using different passwords and eventually gain access to the targeted account using a brute force attack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grandstream Networks UCM6510to a version that resolves this vulnerability.Fixed in v1.0.20.52
Event History
Frequently Asked Questions
What is the severity of CVE-2025-28172?
The severity of CVE-2025-28172 is considered high due to the potential for brute force attacks leading to unauthorized access.
How do I fix CVE-2025-28172?
To fix CVE-2025-28172, you should upgrade to Grandstream UCM6510 version 1.0.20.53 or later.
What types of attacks can CVE-2025-28172 facilitate?
CVE-2025-28172 can facilitate brute force attacks that allow attackers to gain unauthorized access to user accounts.
Who is affected by CVE-2025-28172?
CVE-2025-28172 affects users of Grandstream UCM6510 versions up to and including 1.0.20.52.
Is there a workaround for CVE-2025-28172?
A potential workaround for CVE-2025-28172 includes implementing account lockout policies to limit excessive authentication attempts.