RCE in Grandstream Ucm6202
CVE-2020-5757
Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. An authenticated remote attacker can bypass command injection mitigations and execute commands as the root user by sending a crafted HTTP POST to the UCM's "New" HTTPS API.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.069 (93.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Grandstream Ucm6202
- Grandstream Ucm6202_firmware
- Grandstream Ucm6204
- Grandstream Ucm6204_firmware
- Grandstream Ucm6208
- Grandstream Ucm6208_firmware
- N/a Grandstream Ucm6200 Series — versions Versions 1.0.20.23 and below
Weakness classification (CWE)
References
- vulnreport@tenable.com (x_refsource_CONFIRM, Not Applicable)
- nvd@nist.gov (Third Party Advisory)
Frequently asked questions
- What is CVE-2020-5757?
- CVE-2020-5757 is a critical-severity vulnerability in Grandstream Ucm6202, classified under OS Command Injection. CVSS score: 9.8/10. Published 2020-07-17.
- How severe is CVE-2020-5757?
- Critical severity. CVSS v3 base score is 9.8 out of 10.