by Kastro
Paper/Archive/CVE-2020-5723

CVE-2020-5723

tenable — The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database.

EPSS 6%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 93.2.932 × 2018.6No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database. This could allow an attacker to retrieve all passwords and possibly gain elevated privileges.

Affected

ProductAffectedFixed inSource
Grandstream UCM6200 series1.0.20.20 and below–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reftenable.com/security/research/tra-2020-17