CVE-2025-28171

MediumCVSS 6.5

Published: 29/07/2025(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

23th percentile - higher than 23% of all known CVEs

Summary

A vulnerability in Grandstream UCM6510 version 1.0.20.52 and earlier allows a remote attacker to obtain sensitive information through the login function at /cgi and /webrtccgi paths.

Risk Assessment

The risk involves potential leakage of confidential data such as passwords or session tokens, which could lead to unauthorized system access and further attacks.

Recommendation

It is recommended to immediately update the firmware to the latest version and restrict access to the /cgi and /webrtccgi interfaces to trusted networks only.

Original NVD description (English source)

An issue in Grandstream UCM6510 v.1.0.20.52 and before allows a remote attacker to obtain sensitive information via the Login function at /cgi and /webrtccgi.