PT-2024-15859 · Grandstream · Grandstream Ucm Series Ip Pbx
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Grandstream UCM Series IP PBX versions prior to 1.0.20.52
Description
The issue is related to a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP request. Authentication may be possible using a default user and password. The affected models are the UCM6202, UCM6204, UCM6208, and UCM6510.
Recommendations
For versions prior to 1.0.20.52, update the firmware to version 1.0.20.52 or later to resolve the issue. As a temporary workaround, consider restricting access to the HTTP interface until the update is applied. Additionally, changing default user and password settings can help minimize the risk of exploitation.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Grandstream Ucm Series Ip Pbx