CVE-2020-5725

🗓️ 30 Mar 2020 19:03:44Reported by tenableType

cve🔗 web.nvd.nist.gov👁 96 Views🌐 WEB

The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint

Reporter	Title	Published	Views	Family All 11
0day.today	Grandstream UCM6200 Series WebSocket 1.0.20.20 - (user_password) SQL Injection Exploit	31 Mar 202000:00	–	zdt
Circl	CVE-2020-5725	18 Dec 202303:36	–	circl
CNVD	Grandstream UCM6200 SQL Injection Vulnerability	31 Mar 202000:00	–	cnvd
Cvelist	CVE-2020-5725	30 Mar 202019:03	–	cvelist
Exploit DB	Grandstream UCM6200 Series WebSocket 1.0.20.20 - 'user_password' SQL Injection	31 Mar 202000:00	–	exploitdb
EUVD	EUVD-2020-26884	7 Oct 202500:30	–	euvd
exploitpack	Grandstream UCM6200 Series WebSocket 1.0.20.20 - user_password SQL Injection	31 Mar 202000:00	–	exploitpack
NVD	CVE-2020-5725	30 Mar 202020:15	–	nvd
Packet Storm	Grandstream UCM6200 Series WebSocket 1.0.20.20 SQL Injection	31 Mar 202000:00	–	packetstorm
Prion	Sql injection	30 Mar 202020:15	–	prion

NVD

Node

grandstream ucm6202_firmwareRange<1.0.20.22

AND

grandstream ucm6202Match-

Node

grandstream ucm6204_firmwareRange<1.0.20.22

AND

grandstream ucm6204Match-

Node

grandstream ucm6208_firmwareRange<1.0.20.22

AND

grandstream ucm6208Match-

[
  {
    "product": "Grandstream UCM6200 series",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "1.0.20.20 and below"
      }
    ]
  }
]

Source	Link
tenable	www.tenable.com/security/research/tra-2020-17
packetstormsecurity	www.packetstormsecurity.com/files/156976/Grandstream-UCM6200-Series-WebSocket-1.0.20.20-SQL-Injection.html

Parameter	Position	Path	Description	CWE
username	path	/websockify	SQLi via WebSocket login at /websockify endpoint (time-based) to disclose user_password	CWE-89

21 Nov 2024 05:34Current

6.2Medium risk

Vulners AI Score6.2

CVSS 24.3

CVSS 3.15.9

EPSS0.00389

CWE-89