CVE-2020-5722
Last modified
CVE-2020-5722 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17.. CISA has confirmed active exploitation in the wild. EPSS estimates a 83.93% chance of exploitation in the next 30 days.
Description
The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Grandstream | Ucm6200 Firmware | < 1.0.19.20 |
References
- http://packetstormsecurity.com/files/156876/UCM6202-1.0.18.13-Remote-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/165708/Grandstream-UCM62xx-IP-PBX-sendPasswordEmail-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
- https://www.tenable.com/security/research/tra-2020-15Exploit, Third Party Advisory
- http://packetstormsecurity.com/files/156876/UCM6202-1.0.18.13-Remote-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/165708/Grandstream-UCM62xx-IP-PBX-sendPasswordEmail-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
- https://www.tenable.com/security/research/tra-2020-15Exploit, Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5722US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2020-5722?
How severe is CVE-2020-5722?
How do I fix CVE-2020-5722?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-5683Directory traversal vulnerability in GROWI versions prior to…7.5
- CVE-2020-5684iSM client versions from V5.1 prior to V12.1 running on NEC …4.8
- CVE-2020-5685UNIVERGE SV9500 series from V1 to V7and SV8500 series from S…9.8
- CVE-2020-5686Incorrect implementation of authentication algorithm issue i…7.5
- CVE-2020-5720MikroTik WinBox before 3.21 is vulnerable to a path traversa…5.9
- CVE-2020-5721MikroTik WinBox 3.22 and below stores the user's cleartext p…5.5
- CVE-2020-5723The UCM6200 series 1.0.20.22 and below stores unencrypted us…9.8
- CVE-2020-5724The Grandstream UCM6200 series before 1.0.20.22 is vulnerabl…7.5
- CVE-2020-5725The Grandstream UCM6200 series before 1.0.20.22 is vulnerabl…5.9
- CVE-2020-5726The Grandstream UCM6200 series before 1.0.20.22 is vulnerabl…7.5
- CVE-2020-5727Authentication bypass using an alternate path or channel in …4.6
- CVE-2020-5728OpenMRS 2.9 and prior copies "Referrer" header values into a…6.1
Are you affected by CVE-2020-5722?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST