Grandstream GXP1628 CVE-2025-28170

Exploitation requires network reachability to the GXP1628's embedded web/management interface (HTTP/HTTPS) and that the device runs firmware 1.0.4.130 or earlier with directory listing enabled - which the advisory states is the default configuration for this model. The specific enabling condition is the web server's directory-listing/autoindex behavior serving directories that lack an index file. Limiting factors: the CVSS vector encodes PR:L, so some privilege level may be needed despite the description's 'unauthorized access' wording (unconfirmed); and real-world exposure is sharply reduced when phones sit on an isolated voice VLAN unreachable from attacker-controlled networks. Impact is primarily information disclosure rather than code execution.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L, score 7.6) rates this network-exploitable, low-complexity, with high confidentiality impact but only low integrity/availability impact - consistent with a read-oriented information-disclosure bug. Two signals conflict and should be flagged: the description states 'unauthorized access,' implying no authentication, yet the vector encodes PR:L (some privilege required) - verify with the vendor whether the listing is reachable pre-authentication. Similarly, I:L and A:L are questionable for a pure directory-listing flaw, which is typically confidentiality-only. EPSS is low (0.31%) and there is no KEV listing, indicating no evidence of widespread automated exploitation, but publicly available exploit code lowers the practical barrier for a motivated attacker who can reach the phone's web interface. Net: a real but moderate priority, most acute where these phones are exposed to untrusted networks; on a segmented voice VLAN the real-world exposure is considerably lower.

An attacker who can reach the GXP1628 web interface browses to a directory path lacking an index page and receives an auto-generated file listing, then downloads exposed configuration or provisioning files to harvest SIP credentials or device settings. Because publicly available exploit code exists and attack complexity is low, this requires only HTTP access to the phone and no sophisticated tooling. Harvested SIP account data could then be reused to register rogue endpoints or commit toll fraud.