Grandstream UCM6510 Firmware vulnerabilities

3 CVEs affecting Grandstream UCM6510 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-28171, published 2025-07-29.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-0840, published 2024-04-29. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary…
CVE-2025-28171, published 2025-07-29. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. An issue in Grandstream UCM6510 v.1.0.20.52 and before allows a remote attacker to obtain sensitive information via the Login function at /cgi and /webrtccgi.
CVE-2025-28172, published 2025-07-29. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Grandstream Networks UCM6510 v1.0.20.52 and before is vulnerable to Improper Restriction of Excessive Authentication Attempts. An attacker can perform an arbitrary number of authentication attempts…