high7.5Public exploit code
CVE-2020-5726
The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Grandstream UCM6200 Series CTI Interface - 'user_password' SQL Injection2020-03-31 · webapps · hardware
Impact
The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888. A remote unauthenticated attacker can invoke the challenge action with a crafted username and discover user passwords.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Grandstream | Ucm6202 Firmware | before 1.0.20.22 |
| Grandstream | Ucm6204 Firmware | before 1.0.20.22 |
| Grandstream | Ucm6208 Firmware | before 1.0.20.22 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/156977/Grandstream-UCM6200-Series-CTI-Interface-SQL-Injection.html
- https://www.tenable.com/security/research/tra-2020-17
- http://packetstormsecurity.com/files/156977/Grandstream-UCM6200-Series-CTI-Interface-SQL-Injection.html
- https://www.tenable.com/security/research/tra-2020-17