PT-2025-31221 · Grandstream Networks · Gxp1628

Exek1El · Published 2025-07-29 · Updated 2025-08-03 · CVE-2025-28170

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Grandstream Networks GXP1628 versions 1.0.4.130 and earlier

Description The Grandstream Networks GXP1628 device is susceptible to incorrect access control due to directory listing being enabled. This allows unauthorized access to sensitive directories and files.

Recommendations Disable directory listing on Grandstream Networks GXP1628 versions 1.0.4.130 and earlier.

Exploit

Fix

Weakness Enumeration

CWE-548

Related Identifiers

CVE-2025-28170

Affected Products

Gxp1628

References · 8

• 🔥 https://gist.github.com/Exek1el/928ea6fd06d3b48c1c91cfdc30317d8d · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-28170 · Security Note
• https://osv.dev/vulnerability/CVE-2025-28170 · Vendor Advisory
• https://twitter.com/cracbot/status/1951961303779549694 · Twitter Post
• http://grandstream.com · Note
• https://t.me/CVEtracker/28675 · Telegram Post
• https://twitter.com/CVEnew/status/1950244924131094905 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1950269558247366695 · Twitter Post