CVEvulnerability

CVE-2020-5723

9.8 CRITICAL Published 2020-03-30 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-03-30
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-312

Description

The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database. This could allow an attacker to retrieve all passwords and possibly gain elevated privileges.

Affected configurations

• grandstream ucm6202 firmware (< 1.0.20.22) • grandstream ucm6204 firmware (< 1.0.20.22) • grandstream ucm6208 firmware (< 1.0.20.22)

Related

Weakness · CWE (1)

  • CWE-312 Cleartext Storage of Sensitive Information weakness

References