Vendors / Grandstream Records 57 All Threatist records
Exploited (KEV) 1
CVSS critical 14
CVSS high 32
Exploited now Grandstream records in CISA KEV
Components Products in the NVD configurations · select one to filter the records Priority HIGH 67
Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the backupUCMConfig file-backup parameter to the /cgi? URI.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.43861 · Published 2019-03-30 · No fix listed CWE-78
Priority MEDIUM 61
Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to conduct SQL injection attacks via the sord parameter in a listCodeblueGroup API call to the /cgi? URI.
CVSS 3.0 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.27884 · Published 2019-03-30 · No fix listed CWE-89
Priority MEDIUM 52
Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.06926 · Published 2020-07-17 · No fix listed CWE-78
Priority MEDIUM 51
The UCM6200 series 1.0.20.22 and below stores unencrypted user passwords in an SQLite database.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.05894 · Published 2020-03-30 · No fix listed CWE-312
Priority MEDIUM 48
Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via SSH.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03204 · Published 2020-07-17 · No fix listed CWE-78
Priority MEDIUM 47
The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.12164 · Published 2020-03-30 · No fix listed CWE-89
Priority MEDIUM 45
Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.04375 · Published 2020-07-17 · No fix listed CWE-78
Priority MEDIUM 40
The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.04332 · Published 2020-03-30 · No fix listed CWE-89
Priority LOW 30
The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint.
CVSS 3.1 MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.01752 · Published 2020-03-30 · No fix listed CWE-89
Open these records in search → All records by CVSS severity
14 32 11 0 0
THREATIST.IORead the docs