critical9.8
CVE-2020-5723
The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database.
Impact
The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database. This could allow an attacker to retrieve all passwords and possibly gain elevated privileges.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Grandstream | Ucm6202 Firmware | before 1.0.20.22 |
| Grandstream | Ucm6204 Firmware | before 1.0.20.22 |
| Grandstream | Ucm6208 Firmware | before 1.0.20.22 |