Grandstream UCM6510 CVE-2025-28171

No authentication is required - exploitation targets the Login function itself, which is a pre-authentication endpoint accessible to any network-reachable host. The /cgi and /webrtccgi paths must be reachable by the attacker, meaning the UCM6510 web interface must be exposed on the network (internet-facing deployments face the highest risk; internally-accessible devices require a foothold on the local network first). No special configuration, user interaction, or victim-side action is needed. Limiting factors: the vulnerability is specific to firmware v.1.0.20.52 and earlier - devices running a patched firmware release are not affected. Devices with management interfaces firewalled from untrusted networks are not directly exploitable remotely.

The NVD-assigned CVSS 3.1 score of 6.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N classifies this as medium severity with a network-accessible, zero-complexity, unauthenticated attack path. The I:L (integrity) component in the provided vector is inconsistent with the description, which exclusively describes sensitive information retrieval - this discrepancy should be verified against the vendor advisory. EPSS at 0.40% (32nd percentile) is low, indicating no widespread automated exploitation has been observed at time of analysis. Critically, a public proof-of-concept is available via GitHub gist (Exek1el), which substantially lowers the technical bar for exploitation even if EPSS has not yet reflected this. No CISA KEV listing is present, confirming no confirmed mass exploitation. The realistic risk profile is: targeted or opportunistic against internet-exposed UCM6510 management interfaces, with credential or session data harvesting as the likely immediate objective enabling secondary access to the PBX system.

An attacker scans the internet for exposed Grandstream UCM6510 management interfaces (default port 8089 or 443) and identifies targets running firmware 1.0.52 or earlier. Using the publicly available proof-of-concept on GitHub, the attacker sends a crafted unauthenticated HTTP request to the /cgi or /webrtccgi Login endpoint and receives a response containing sensitive information such as credentials or session tokens. The attacker leverages the harvested data to authenticate to the PBX system, enumerate extensions, intercept call data, or pivot to internal network resources reachable via the UCM6510.