CVE-2020-5722: Grandstream Networks UCM6200 Series SQL Injection Vulnerability

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2022-01-28
EPSS: 84.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-03-23 · updated 2026-06-17
Weakness: CWE-89

Description

The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17.

Affected products

Grandstream UCM6200 series: before 1.0.19.20 — fixed in 1.0.19.20

How to fix

Upgrade to a fixed version: Grandstream UCM6200 series 1.0.19.20. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/156876/UCM6202-1.0.18.13-Remote-Command-Injection.html
http://packetstormsecurity.com/files/165708/Grandstream-UCM62xx-IP-PBX-sendPasswordEmail-Remote-Code-Execution.html
https://www.tenable.com/security/research/tra-2020-15
http://packetstormsecurity.com/files/156876/UCM6202-1.0.18.13-Remote-Command-Injection.html
http://packetstormsecurity.com/files/165708/Grandstream-UCM62xx-IP-PBX-sendPasswordEmail-Remote-Code-Execution.html
https://www.tenable.com/security/research/tra-2020-15
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5722

Get alerted when CVE-2020-5722 or the next vulnerability affects your stack