by Kastro
Paper/Archive/CVE-2020-5757

CVE-2020-5757

tenable — Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP.

EPSS 7%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 94.1.941 × 2018.8No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. An authenticated remote attacker can bypass command injection mitigations and execute commands as the root user by sending a crafted HTTP POST to the UCM's "New" HTTPS API.

Affected

ProductAffectedFixed inSource
Grandstream UCM6200 SeriesVersions 1.0.20.23 and below–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reftenable.com/security/research/tra-2020-42