CVE-2020-5722
CriticalActively exploited (CISA KEV)
Description
The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17.
SeverityCritical
CVSS9.8
Exploit probability—
ProductGrandstream UCM6200
PublishedMar 23, 2020
First seenMar 23, 2020
Added to KEVJan 28, 2022
Weakness typeCWE-89SQL injection
How to fix
CISA required action
Apply updates per vendor instructions.
CISA due date: Jul 28, 2022Update
- grandstream ucm6200_firmware1.0.19.20 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| grandstream ucm6200_firmware | v < 1.0.19.20 | 1.0.19.20 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.