CVE-2020-5722

Grandstream Networks UCM6200 Series SQL Injection Vulnerability

Exploited in attacks Critical 9.8 Attack chance: 84%

What it is

The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17.

CISA: Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. Exploitation can allow for code execution as root.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: July 28, 2022

Added to the CISA list: January 28, 2022
Published: March 23, 2020
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 84% in the top 0.3% of all known vulnerabilities
Weakness: CWE-89
More details: NVD · CVE.org · CISA

All references (3)

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.