Risk Letters

Exploited vulnerability

CVE-2020-5722

TLP:CLEAR

Grandstream Networks UCM6200 Series SQL Injection Vulnerability

Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. Exploitation can allow for code execution as root.

Facts

  • Vendor: Grandstream
  • Product: UCM6200
  • CVSS: 9.8
  • EPSS (probability of exploitation within 30 days): 84.3 %
  • On CISA's Known Exploited Vulnerabilities list since: 28 January 2022
  • First known exploitation: 28 January 2022
  • CISA's deadline for US federal agencies: 28 July 2022
  • Weakness: CWE-89
  • First seen by Risk Letters: 28 January 2022

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD