CVE-2020-5725CWE-89

The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint

published March 30, 2020

CVSS
—
EPSS
2%
Percentile
77.7
In the wild
Unconfirmed
What it is

The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint. A remote unauthenticated attacker can invoke the login action with a crafted username and, through the use of timing attacks, can discover user passwords.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01752 · 77.7th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2020-03-30T19:03Z
EPSS history
Timeline
  • 30 MAR 19:03Z
    The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint
    cvelistv5