CVE-2020-5724CWE-89

The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint

published March 30, 2020

CVSS
—
EPSS
12%
Percentile
96.2
In the wild
Unconfirmed
What it is

The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint. A remote unauthenticated attacker can invoke the challenge action with a crafted username and discover user passwords.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.12164 · 96.2th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2020-03-30T19:03Z
EPSS history
Timeline
  • 30 MAR 19:03Z
    The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint
    cvelistv5