CVE-2025-28170
📋 TL;DR
Grandstream GXP1628 IP phones with firmware version 1.0.4.130 or earlier have directory listing enabled by default, allowing attackers to browse sensitive files without authentication. This affects all organizations using these devices with vulnerable firmware. Attackers can access configuration files, logs, and potentially credentials.
💻 Affected Systems
- Grandstream GXP1628
📦 What is this software?
Gxp1628 Firmware by Grandstream
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full access to device configuration, extract credentials, pivot to internal networks, and compromise other systems.
Likely Case
Unauthorized users access sensitive configuration files, potentially obtaining credentials for other systems or learning internal network details.
If Mitigated
With proper network segmentation and access controls, impact is limited to the device itself without lateral movement.
🎯 Exploit Status
Exploitation requires only web browser access to device IP. The GitHub gist demonstrates directory traversal.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://grandstream.com
Restart Required: No
Instructions:
1. Check Grandstream website for firmware updates. 2. Download latest firmware. 3. Upload via web interface. 4. Apply update. 5. Verify directory listing is disabled.
🔧 Temporary Workarounds
Disable Directory Listing via Configuration
allModify web server configuration to disable directory browsing
Network Access Control
allRestrict web interface access to trusted IPs only
🧯 If You Can't Patch
- Segment devices on isolated VLAN with strict firewall rules
- Implement network monitoring for unusual access patterns to device web interfaces
🔍 How to Verify
Check if Vulnerable:
Access device IP in browser, attempt to navigate to known directories like /tmp or /var. If directory contents are displayed, device is vulnerable.Check Version:
Login to web interface > System Status > Firmware VersionVerify Fix Applied:
After applying workarounds, attempt same directory access. Should receive 403 Forbidden or similar error instead of directory listing.📡 Detection & Monitoring
Log Indicators:
- Multiple 200 OK responses to directory paths
- Access to sensitive file paths without authentication
Network Indicators:
- HTTP requests to device IP with directory traversal patterns
- Unusual traffic to device web interface from external IPs
SIEM Query:
source="web_logs" AND (uri="*/" OR uri="*?C=*" OR uri="*?M=*") AND response="200" AND user_agent!="Grandstream"