Grandstream UCM6510 CVE-2025-28172

No special configuration is required - the vulnerability exists in the default authentication implementation of the UCM6510 web management and/or SIP interface across all firmware versions through v1.0.20.52. Exploitation requires network-level reachability to the device's authentication endpoint (the management web interface port, typically TCP 8089/443, or SIP port 5060/5061). The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms unauthenticated, low-complexity remote exploitation with no user interaction. Exploitation effectiveness is limited by: account password strength (strong passwords make brute-force statistically infeasible regardless of the missing lockout), network exposure (devices behind NAT or firewalls without direct internet exposure are not reachable), and the time required to exhaust credential space (high-entropy passwords extend attack duration significantly). There is no non-default configuration flag that enables or disables this weakness - it is present in the authentication layer by default.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) accurately reflects the low-complexity, unauthenticated network vector. Real-world risk is moderate but highly dependent on account password quality: strong, unique passwords significantly limit exploitability despite the absence of lockout. EPSS at 0.28% (20th percentile) indicates low observed exploitation activity in the wild, and the vulnerability is not listed in CISA KEV - no confirmed active exploitation. The GitHub gist reference (by researcher Exek1el) constitutes a public disclosure that may serve as informal POC documentation, increasing the likelihood that exploitation tooling will be developed. Grandstream UCM6510 units exposed directly to the internet with default or weak credentials represent the highest real-world risk profile. The impact is bounded by account privilege - administrative account compromise would have significantly higher real-world consequence than the CVSS C:L/I:L ratings suggest for that specific scenario.

An attacker identifies a Grandstream UCM6510 management interface exposed on the internet using a Shodan search for the device's HTTP banner. Using an automated credential-stuffing tool with a list of common VoIP passwords or previously leaked credentials, the attacker submits thousands of login attempts over minutes without being locked out or rate-limited. Successfully compromising an administrative account, the attacker gains control of the PBX, potentially enabling toll fraud, call interception, or further lateral movement into the corporate network.