Vulnerability CVE-2020-5726
Published: 2020-03-30

Description:
The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888. A remote unauthenticated attacker can invoke the challenge action with a crafted username and discover user passwords.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
Grandstream UCM6200 Series CTI Interface SQL Injection
Jacob Baines
02.04.2020
High
Grandstream UCM6200 Series CTI Interface user_password SQL Injection
Jacob Baines
08.04.2020

Type:

CWE-89

 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None

 References:
http://packetstormsecurity.com/files/156977/Grandstream-UCM6200-Series-CTI-Interface-SQL-Injection.html
https://www.tenable.com/security/research/tra-2020-17
Copyright 2024, cxsecurity.com

 

Back to Top