PT-2020-18678 · Grandstream · Grandstream Ucm6200

Published 2020-07-17 · Updated 2020-07-23 · CVE-2020-5757

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Grandstream UCM6200 series firmware version 1.0.20.23 and below

Description The issue allows an authenticated remote attacker to execute commands as the root user by sending a crafted HTTP POST to the "New" HTTPS API, bypassing command injection mitigations.

Recommendations For Grandstream UCM6200 series firmware version 1.0.20.23 and below, consider restricting access to the "New" HTTPS API until a patch is available. As a temporary workaround, limit the privileges of the root user to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-5757

Affected Products

Grandstream Ucm6200

References · 4

• https://osv.dev/vulnerability/CVE-2020-5757 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5757 · Security Note
• https://tenable.com/security/research/tra-2020-42 · Note
• https://tenable.com/cve/CVE-2020-5757 · Note