CVE-2020-5724
30.03.2020, 20:15
The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint. A remote unauthenticated attacker can invoke the challenge action with a crafted username and discover user passwords.
| Vendor | Product | Version |
|---|---|---|
| grandstream | ucm6202_firmware | 𝑥 < 1.0.20.22 |
| grandstream | ucm6204_firmware | 𝑥 < 1.0.20.22 |
| grandstream | ucm6208_firmware | 𝑥 < 1.0.20.22 |
𝑥
= Vulnerable software versions