CVE-2025-28170

HighCVSS 7.6/10Last modified Jul 5, 2026

Description

Grandstream Networks GXP1628 <=1.0.4.130 is vulnerable to Incorrect Access Control. The device is configured with directory listing enabled, allowing unauthorized access to sensitive directories and files.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-548

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gist.github.com/Exek1el/928ea6fd06d3b48c1c91cfdc30317d8dExploit, Third Party Advisory

Timeline

Published: Jul 29, 2025
Last modified: Jul 5, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-281716.5An issue in Grandstream UCM6510 v.1.0.20.52 and before allows a remote attacker to obtain sensitive information via the Login function at /c CVE-2025-281726.5Grandstream Networks UCM6510 v1.0.20.52 and before is vulnerable to Improper Restriction of Excessive Authentication Attempts. An attacker c CVE-2025-28183.5A vulnerability was reported in version 1.0 of the Bluetooth Transmission Alliance protocol adopted by Motorola Smart Connect Android Applic CVE-2025-28196.6There is a risk of unauthorized file uploads in GT-SoftControl and potential file overwrites due to insufficient validation in the file sele CVE-2025-281979.1Crawl4AI <=0.4.247 is vulnerable to SSRF in /crawl4ai/async_dispatcher.py.CVE-2025-281985.9A SQL injection vulnerability in Hitout car sale 1.0 allows a remote attacker to obtain sensitive information via the orderBy parameter of t CVE-2025-28206.5An authenticated attacker can compromise the availability of the device via the network CVE-2025-282009.8Victure RX1800 EN_V1.0.0_r12_110933 was discovered to utilize a weak default password which includes the last 8 digits of the Mac address.CVE-2025-282016.8An issue in Victure RX1800 EN_V1.0.0_r12_110933 allows physically proximate attackers to execute arbitrary code or gain root access.CVE-2025-282028.8Incorrect access control in Victure RX1800 EN_V1.0.0_r12_110933 allows attackers to enable SSH and Telnet services without authentication.CVE-2025-282038.8Victure RX1800 EN_V1.0.0_r12_110933 was discovered to contain a command injection vulnerability.CVE-2025-28215.3The Search Exclude plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the get_rest