Critical severity · published Jul 17, 2020
CVE-2020-5759
Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via SSH
9.8
CVSS
3.2%
EPSS
No
On KEV
Description
Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via SSH. An authenticated remote attacker can execute commands as the root user by issuing a specially crafted "unset" command.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.2% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UF
Ucm6202 Firmware · Grandstream
through 1.0.20.23 · source: NVD
UF
Ucm6204 Firmware · Grandstream
through 1.0.20.23 · source: NVD
UF
Ucm6208 Firmware · Grandstream
through 1.0.20.23 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-5759
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-5759
Not Applicable
https://www.tenable.com/security/research/tra-2020-42
Third Party Advisory
https://www.tenable.com/cve/CVE-2020-5759
More from Ucm6202 Firmware
9.8
CVE-2020-5757
Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP
9.8
CVE-2020-5723
The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database
8.8
CVE-2020-5758
Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP
7.5
CVE-2020-5726
The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888
7.5
CVE-2020-5724
The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint