CVE-2025-28170: Grandstream GXP1628 directory listing in web interface

CVE-2025-28170 · Severity: high · CVSS 7.6 · Published 2025-07-29

Grandstream GXP1628 VoIP phones are affected by a security flaw that allows unauthorized users to view internal system directories. By accessing these directories, an attacker could download sensitive configuration files or logs, potentially leading to the exposure of private communication data or device credentials. This could compromise the privacy of phone calls and the security of the corporate telephony network.

Vendors: Grandstream.

Quick answers

Is CVE-2025-28170 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-28170 being exploited in the wild.
How severe is CVE-2025-28170?
High severity, with a CVSS score of 7.6, published 29 July 2025.
Which products and versions are affected?
Grandstream Networks GXP1628 <=1.0.4.130.
Is there a fix for CVE-2025-28170?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-28170 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-28170?
Check whether you run Grandstream Gxp1628 or Grandstream Gxp1628 Firmware. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Grandstream GXP1628 VoIP phone (firmware <=1.0.4.130) is vulnerable to information disclosure due to incorrect access control (CWE-548). The device's web server is configured with directory listing enabled for sensitive paths such as /webapp/, /cgi-bin/, and /json/contents/. A remote attacker with low privileges can navigate to these directories via a web browser to enumerate and download sensitive files, including configuration data and logs. This exposure can be leveraged to facilitate further attacks or system compromise. Users are advised to check for firmware updates or manually disable directory listing if the configuration allows.

Affected products

  • Grandstream Networks GXP1628 <=1.0.4.130

Timeline

  • 2025-07-16: disclosed: Initial vulnerability report created on GitHub Gist
  • 2025-07-29: advisory: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.