PT-2020-18680 · Grandstream · Grandstream Ucm6200

Published 2020-07-17 · Updated 2020-07-23 · CVE-2020-5759

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Grandstream UCM6200 series firmware version 1.0.20.23 and below

Description The issue allows an authenticated remote attacker to execute commands as the root user by issuing a specially crafted "unset" command via SSH, which can lead to OS command injection.

Recommendations For Grandstream UCM6200 series firmware version 1.0.20.23 and below, update to a version above 1.0.20.23 to resolve the issue. At the moment, there is no other information about additional mitigation measures.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-5759

Affected Products

Grandstream Ucm6200

References · 4

• https://osv.dev/vulnerability/CVE-2020-5759 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5759 · Security Note
• https://tenable.com/cve/CVE-2020-5759 · Note
• https://tenable.com/security/research/tra-2020-42 · Note