CVE-2020-5758CWE-78

Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP

published July 17, 2020

CVSS
—
EPSS
4%
Percentile
91.2
In the wild
Unconfirmed
What it is

Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. An authenticated remote attacker can execute commands as the root user by sending a crafted HTTP GET to the UCM's "Old" HTTPS API.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04375 · 91.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2020-07-17T20:35Z
EPSS history
Timeline
  • 17 JUL 20:35Z
    Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP
    cvelistv5