critical9.8Known exploitedPublic exploit code
CVE-2020-5722
Grandstream Networks UCM6200 Series SQL Injection Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-01-28. Federal due date: 2022-07-28.
Apply updates per vendor instructions.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- UCM6202 1.0.18.13 - Remote Command Injection2020-03-24 · webapps · hardware
Impact
The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Grandstream | Ucm6200 Firmware | before 1.0.19.20 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://packetstormsecurity.com/files/156876/UCM6202-1.0.18.13-Remote-Command-Injection.html
- http://packetstormsecurity.com/files/165708/Grandstream-UCM62xx-IP-PBX-sendPasswordEmail-Remote-Code-Execution.html
- https://www.tenable.com/security/research/tra-2020-15
- http://packetstormsecurity.com/files/156876/UCM6202-1.0.18.13-Remote-Command-Injection.html
- http://packetstormsecurity.com/files/165708/Grandstream-UCM62xx-IP-PBX-sendPasswordEmail-Remote-Code-Execution.html
- https://www.tenable.com/security/research/tra-2020-15
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5722