CVE-2025-28172
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Grandstream Networks UCM6510 version 1.0.20.52 and earlier lacks proper restriction of excessive authentication attempts. An attacker can perform unlimited login attempts with different passwords, enabling a brute force attack to gain access to targeted accounts.
Risk Assessment
The risk is that an attacker can compromise administrator or user accounts through brute force, leading to unauthorized access to the telephony system and sensitive data.
Recommendation
Immediately update the device firmware to the latest version that includes rate-limiting mechanisms for login attempts. Additionally, enforce strong password policies and monitor logs for unusual authentication activity.
Original NVD description (English source)
Grandstream Networks UCM6510 v1.0.20.52 and before is vulnerable to Improper Restriction of Excessive Authentication Attempts. An attacker can perform an arbitrary number of authentication attempts using different passwords and eventually gain access to the targeted account using a brute force attack.