Critical severity · published Mar 23, 2020
CVE-2020-5722
Grandstream Networks UCM6200 Series SQL Injection Vulnerability
In wildKEV
9.8
CVSS
84.4%
EPSS
Yes
On KEV
Description
The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)84.4% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Jan 28, 2022
Federal remediation dueJul 28, 2022
Ransomware campaign useNot known
Affected products
Which versions
GU
Grandstream UCM6200 Series ·
Before 1.0.20.17 · source: vendor
UF
Ucm6200 Firmware · Grandstream
before 1.0.19.20 · source: NVD
UC
UCM6200 · Grandstream
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-5722
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-5722
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://www.tenable.com/security/research/tra-2020-15
x_refsource_MISC
http://packetstormsecurity.com/files/156876/UCM6202-1.0.18.13-Remote-Command-Injection.html
x_refsource_MISC
http://packetstormsecurity.com/files/165708/Grandstream-UCM62xx-IP-PBX-sendPasswordEmail-Remote-Code-Execution.html