PT-2020-18646 · Grandstream · Grandstream Ucm6200 Series

Published 2020-03-30 · Updated 2020-04-01 · CVE-2020-5723

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Grandstream UCM6200 series versions 1.0.20.22 and below

Description The issue allows an attacker to retrieve all passwords and possibly gain elevated privileges due to the storage of unencrypted user passwords in an SQLite database.

Recommendations For Grandstream UCM6200 series versions 1.0.20.22 and below, update to a version above 1.0.20.22 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2020-5723

Affected Products

Grandstream Ucm6200 Series

References · 6

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/grandstream_ucm62xx_sql_account_guess.rb · Exploit
• 🔥 https://tenable.com/security/research/tra-2020-17 · Exploit
• https://osv.dev/vulnerability/CVE-2020-5723 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5723 · Security Note
• https://t.me/cvenotify/2260 · Telegram Post
• https://t.me/cybersecuritytechnologies/881 · Telegram Post