CVEvulnerability

CVE-2020-5757

9.8 CRITICAL Published 2020-07-17 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-07-17
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-78

Description

Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. An authenticated remote attacker can bypass command injection mitigations and execute commands as the root user by sending a crafted HTTP POST to the UCM's "New" HTTPS API.

Affected configurations

• grandstream ucm6202 firmware (<= 1.0.20.23) • grandstream ucm6204 firmware (<= 1.0.20.23) • grandstream ucm6208 firmware (<= 1.0.20.23)

Related

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References