Description
The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Grandstream UCM6200 Series | Before 1.0.20.17 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Grandstream UCM62xx IP PBX sendPasswordEmail RCE
exploit/linux/http/grandstream_ucm62xx_sendemail_rce
Exploit-DB 1
- UCM6202 1.0.18.13 - Remote Command Injection EDB-48247 · webapps · Mar 24, 2020
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Grandstream UCM6200 - SQL Injection http/cves/2020/CVE-2020-5722.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.