CVE-2020-5726

EPSS 4.2%CWE-89

Vexday Risk Score

23Low

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS —EPSS 4.2%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

30 Mar 2020Published on NVD

31 Mar 2020Public PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888. A remote unauthenticated attacker can invoke the challenge action with a crafted username and discover user passwords.

Affected products

n/a · Grandstream UCM6200 series

public PoCs found — 2

cve_referencepacketstormsecurity.com/files/156977/Grandstream-UCM6200-Series-CTI-Interface-SQL-Injection.htmlunverified exploitdbwww.exploit-db.com/exploits/48270unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://packetstormsecurity.com/files/156977/Grandstream-UCM6200-Series-CTI-Interface-SQL-Injection.html https://www.tenable.com/security/research/tra-2020-17