CVE-2020-5726CWE-89

The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888

published March 30, 2020

CVSS
—
EPSS
4%
Percentile
91.1
In the wild
Unconfirmed
What it is

The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888. A remote unauthenticated attacker can invoke the challenge action with a crafted username and discover user passwords.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04332 · 91.1th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2020-03-30T19:03Z
EPSS history
Timeline
  • 30 MAR 19:03Z
    The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888
    cvelistv5