CVEvulnerability

CVE-2020-5722

9.8 CRITICAL Known exploited Published 2020-03-23 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Grandstream Networks UCM6200 Series SQL Injection Vulnerability — Grandstream UCM6200

Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. Exploitation can allow for code execution as root.

Added to KEV: 2022-01-28
Remediation due: 2022-07-28
Ransomware use: Unknown
Required action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2020-5722

Status: Analyzed
Published: 2020-03-23
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses: CWE-89

Description

The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17.

Affected configurations

• grandstream ucm6200 firmware (< 1.0.19.20)

Weakness · CWE (1)

CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References