CVE-2024-0840

The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP request. Authentication may be possible using a default user and password. Affected models are the UCM6202, UCM6204, UCM6208, and UCM6510.

• CWE-141

• https://vulncheck.com/advisories/grand-stream-param-injection
• https://vulncheck.com/advisories/grand-stream-param-injection

Published

Apr 29, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-0834The Elementor Addon Elements plugin for WordPress is vulnera…5.4
• CVE-2024-0835The Royal Elementor Kit theme for WordPress is vulnerable to…4.3
• CVE-2024-0836The WordPress Review & Structure Data Schema Plugin – Review…4.3
• CVE-2024-0837The Element Pack Elementor Addons (Header Footer, Free Templ…5.4
• CVE-2024-0838The Happy Addons for Elementor plugin for WordPress is vulne…5.4
• CVE-2024-0839The FeedWordPress plugin for WordPress is vulnerable to Inse…5.3
• CVE-2024-0841A null pointer dereference flaw was found in the hugetlbfs_f…7.8
• CVE-2024-0842The Backuply – Backup, Restore, Migrate and Clone plugin for…7.5
• CVE-2024-0844The Popup More Popups, Lightboxes, and more popup modules pl…7.2
• CVE-2024-0845The PDF Viewer for Elementor plugin for WordPress is vulnera…5.4
• CVE-2024-0847The 5280 Bootstrap Modal Contact Form plugin for WordPress i…4.3
• CVE-2024-0848The AA Cash Calculator plugin for WordPress is vulnerable to…6.1