The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request.
Affects Grandstream UCM62xx series firmware below 1.0.19.20 (RCE) or below 1.0.20.17 (HTML injection) where the web Forgot Password feature is reachable. Fixed in 1.0.20.17.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 1.0.20.17
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Grandstream UCM6200 series of VoIP PBX appliances is affected by this vulnerability. An unauthenticated remote attacker can send a specially crafted HTTP request to gain root-level command execution on the device or inject malicious HTML into password recovery emails.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- n/a Grandstream UCM6200 Series
Before 1.0.20.17
References 3
Questions about CVE-2020-5722
What does this mean?
The web interface's HTTP handling does not properly sanitize input, so an unauthenticated remote request can inject SQL. A crafted username can pass the database lookup and carry shell metacharacters into a popen call, which can lead to shell commands as root, or HTML can be injected into password recovery emails.Source: tenable.com
Am I affected, and how do I check?
UCM62xx series firmware below 1.0.19.20 is affected for the remote code execution issue, and firmware below 1.0.20.17 for the HTML injection issue. The web Forgot Password feature must be reachable and accept a username that is looked up in the SQLite user table, so compare the device's firmware version against these thresholds and check whether that feature is reachable.Source: tenable.com
What should I do about it?
Upgrade to UCM62xx firmware 1.0.20.17 or newer.Source: tenable.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-01-28, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data