CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2020-03-23
Grandstream UCM6200 Series IP PBX Unauthenticated Remote SQL Injection and RCE Vulnerability (CVE-2020-5722) Analysis & Mitigation Guide
[Affected Scope] Grandstream UCM6200 series IP PBX (RCE as root in versions prior to 1.0.19.20; HTML injection in versions prior to 1.0.20.17)
[Impact] Unauthenticated remote attackers can execute arbitrary shell commands with root privileges or inject malicious HTML into password recovery emails via crafted HTTP requests.
[Mitigation] Immediately upgrade the device firmware to the latest secure version (1.0.20.17 or higher) and restrict external access to the management interface.