CVE-2020-5724

🗓️ 30 Mar 2020 19:03:32Reported by tenableType

The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the websockify endpoint

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2020-5724	15 Feb 202217:41	–	circl
CNVD	Grandstream UCM6200 SQL Injection Vulnerability (CNVD-2020-20680)	31 Mar 202000:00	–	cnvd
Cvelist	CVE-2020-5724	30 Mar 202019:03	–	cvelist
Metasploit	Grandstream UCM62xx IP PBX WebSocket Blind SQL Injection Credential Dump	17 Feb 202217:42	–	metasploit
NVD	CVE-2020-5724	30 Mar 202020:15	–	nvd
OSV	CVE-2020-5724	30 Mar 202020:15	–	osv
Packet Storm	Grandstream UCM62xx IP PBX WebSocket Blind SQL Injection Credential Dump	31 Aug 202400:00	–	packetstorm
Prion	Sql injection	30 Mar 202020:15	–	prion
Positive Technologies	PT-2020-18647 · Grandstream · Grandstream Ucm6200	30 Mar 202000:00	–	ptsecurity
Rapid7 Blog	Metasploit Weekly Wrap-Up	18 Feb 202221:24	–	rapid7blog

NVD

Node

grandstream ucm6202_firmwareRange<1.0.20.22

AND

grandstream ucm6202Match-

Node

grandstream ucm6204_firmwareRange<1.0.20.22

AND

grandstream ucm6204Match-

Node

grandstream ucm6208_firmwareRange<1.0.20.22

AND

grandstream ucm6208Match-

[
  {
    "product": "Grandstream UCM6200 series",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "1.0.20.20 and below"
      }
    ]
  }
]

Source	Link
tenable	www.tenable.com/security/research/tra-2020-17

21 Nov 2024 05:34Current

9High risk

Vulners AI Score9

CVSS 25

CVSS 3.17.5

EPSS0.6003

CWE-89