# CVE-2025-28172: Grandstream UCM6510 improper authentication restriction in CGI endpoints

Source: https://junglewise.ai/threats/cve-2025-28172-grandstream-ucm6510-improper-authentication-restriction-in-cgi  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-07-29. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-28172 · Severity: medium · CVSS 6.5 · Published 2025-07-29

Grandstream UCM series VoIP appliances are vulnerable to a security flaw that fails to limit failed login attempts. This allows an attacker to repeatedly guess passwords for user accounts without being locked out. If successful, an attacker could gain unauthorized access to the device's communication management interface, potentially compromising business telephony and user data.

Vendors: [Grandstream](https://junglewise.ai/threats/vendors/grandstream).

## Quick answers

**Is CVE-2025-28172 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-28172 being exploited in the wild.

**How severe is CVE-2025-28172?** Medium severity, with a CVSS score of 6.5, published 29 July 2025.

**Which products and versions are affected?** Grandstream Networks UCM630X Firmware <= 1.0.29.10 (implied).

**Is there a fix for CVE-2025-28172?** A patch was published on 2025-07-29: Firmware updates released (UCM6510 v1.0.20.53) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-28172 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-28172?** Check whether you run Grandstream Ucm6510, Grandstream Ucm6510 Firmware or Grandstream Networks UCM630X Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability (CWE-307) exists in the /cgi and /webrtccgi endpoints of Grandstream UCM series firmware. When interacting with these endpoints using the 'action=challenge' and 'action=login' parameters, the system fails to implement effective rate limiting or account lockout for valid users. Specifically, while the system may decrement a 'remaining_num' counter for invalid users, it allows an attacker who has obtained a valid challenge value to perform an unlimited number of login attempts. This facilitates password brute-forcing and account enumeration. The issue is addressed in UCM6510 firmware version 1.0.20.53 and UCM630X firmware version 1.0.29.11.

## Affected products

- Grandstream Networks UCM6510 firmware <= 1.0.20.52
- Grandstream Networks UCM630X firmware <= 1.0.29.10 (implied)

## Timeline

- 2025-07-16: disclosed: Initial researcher disclosure via GitHub Gist
- 2025-07-29: advisory: CVE published to NVD
- 2025-07-29: patched: Firmware updates released (UCM6510 v1.0.20.53)

## References

- [https://gist.github.com/Exek1el/6291185a87c98d4229181212b2bd5cdf](https://gist.github.com/Exek1el/6291185a87c98d4229181212b2bd5cdf)

## Related threats

- [Grandstream UCM6510 user enumeration in login function](https://junglewise.ai/threats/cve-2025-28171-grandstream-ucm6510-user-enumeration-in-login-function)