cve.bz

CVE-2020-5722

9.8 criticalKEVEPSS 84%

Critical (9.8) in Grandstream UCM6200. In CISA KEV since 2022-01-28. EPSS 84% chance of exploitation in the next 30 days.

The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17.

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
84% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CISA KEV
listed 2022-01-28, due 2022-07-28
CWE
CWE-89
Published
Modified
Record from
the NVD, synced

Affected

References

Check your stackJSON