Read the docs

Grandstream

Records57All Threatist records
Exploited (KEV)1In CISA KEV
CVSS critical14CVSS 9.0–10.0
CVSS high32CVSS 7.0–8.9

Exploited now

Grandstream records in CISA KEV
TI-2020-04650 Grandstream Networks UCM6200 Series SQL Injection Vulnerability Priority CRITICAL 100KEV 2022-01-28

Components

Products in the NVD configurations · select one to filter the records
Ucm6204 Firmware 9 records HIGH Gxp1628 Firmware 7 records HIGH Ht802 Firmware 7 records MEDIUM Ucm6202 Firmware 7 records MEDIUM Ucm6208 Firmware 7 records MEDIUM Gxp1610 Firmware 6 records HIGH Gxp1615 Firmware 6 records HIGH Gxp1620 Firmware 6 records HIGH

Records

7 records in Ucm6208 Firmware · all components

TI-2020-04685 CVE-2020-5757 · GHSA-3f9w-43j6-x43v

OS command injection in Grandstream UCM6200 Series

Priority MEDIUM 52

Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06926 Published 2020-07-17 No fix listed CWE-78
TI-2020-04687 CVE-2020-5759 · GHSA-559m-xqw9-mvgm

OS command injection in Grandstream UCM6200 Series

Priority MEDIUM 48

Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via SSH.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03204 Published 2020-07-17 No fix listed CWE-78
TI-2020-04652 CVE-2020-5724 · GHSA-p4p6-qxv3-3wvj

SQL injection in Grandstream UCM6200 series

Priority MEDIUM 47

The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.12164 Published 2020-03-30 No fix listed CWE-89
TI-2020-04686 CVE-2020-5758 · GHSA-fc8w-q5c3-5m5f

OS command injection in Grandstream UCM6200 Series

Priority MEDIUM 45

Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.04375 Published 2020-07-17 No fix listed CWE-78
TI-2020-04654 CVE-2020-5726 · GHSA-j8g2-wfvh-q3pf

SQL injection in Grandstream UCM6200 series

Priority MEDIUM 40

The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04332 Published 2020-03-30 No fix listed CWE-89
TI-2020-04653 CVE-2020-5725 · GHSA-m9hp-fm3x-p343

SQL injection in Grandstream UCM6200 series

Priority LOW 30

The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01752 Published 2020-03-30 No fix listed CWE-89
Open these records in search →