Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

7 records

Vendor: Grandstream Component: Ucm6202 Firmware Clear all filters
TI-2020-04687 CVE-2020-5759 · GHSA-559m-xqw9-mvgm

OS command injection in Grandstream UCM6200 Series

Priority MEDIUM 48

Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via SSH.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03204 Published 2020-07-17 No fix listed CWE-78
TI-2020-04686 CVE-2020-5758 · GHSA-fc8w-q5c3-5m5f

OS command injection in Grandstream UCM6200 Series

Priority MEDIUM 45

Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.04375 Published 2020-07-17 No fix listed CWE-78
TI-2020-04685 CVE-2020-5757 · GHSA-3f9w-43j6-x43v

OS command injection in Grandstream UCM6200 Series

Priority MEDIUM 52

Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06926 Published 2020-07-17 No fix listed CWE-78
TI-2020-04654 CVE-2020-5726 · GHSA-j8g2-wfvh-q3pf

SQL injection in Grandstream UCM6200 series

Priority MEDIUM 40

The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04332 Published 2020-03-30 No fix listed CWE-89
TI-2020-04653 CVE-2020-5725 · GHSA-m9hp-fm3x-p343

SQL injection in Grandstream UCM6200 series

Priority LOW 30

The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01752 Published 2020-03-30 No fix listed CWE-89
TI-2020-04652 CVE-2020-5724 · GHSA-p4p6-qxv3-3wvj

SQL injection in Grandstream UCM6200 series

Priority MEDIUM 47

The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.12164 Published 2020-03-30 No fix listed CWE-89