Executive brief
Grandstream UCM series VoIP appliances are vulnerable to a security flaw that fails to limit failed login attempts. This allows an attacker to repeatedly guess passwords for user accounts without being locked out. If successful, an attacker could gain unauthorized access to the device's communication management interface, potentially compromising business telephony and user data.
Technical details
The vulnerability (CWE-307) exists in the /cgi and /webrtccgi endpoints of Grandstream UCM series firmware. When interacting with these endpoints using the 'action=challenge' and 'action=login' parameters, the system fails to implement effective rate limiting or account lockout for valid users. Specifically, while the system may decrement a 'remaining_num' counter for invalid users, it allows an attacker who has obtained a valid challenge value to perform an unlimited number of login attempts. This facilitates password brute-forcing and account enumeration. The issue is addressed in UCM6510 firmware version 1.0.20.53 and UCM630X firmware version 1.0.29.11.
Affected products
- Grandstream Networks UCM6510 firmware <= 1.0.20.52
- Grandstream Networks UCM630X firmware <= 1.0.29.10 (implied)
Timeline
- 2025-07-16: disclosed: Initial researcher disclosure via GitHub Gist
- 2025-07-29: advisory: CVE published to NVD
- 2025-07-29: patched: Firmware updates released (UCM6510 v1.0.20.53)