Paper/Archive/CVE-2020-5759

CVE-2020-5759

tenable — Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via SSH.

EPSS 3%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 88.2.882 × 2017.6 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via SSH. An authenticated remote attacker can execute commands as the root user by issuing a specially crafted "unset" command.

Affected

ProductAffectedFixed inSource

Grandstream UCM6200 SeriesVersions 1.0.20.23 and below–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reftenable.com/security/research/tra-2020-42