CVE-2019-10663

—

CVSS 3.0

8.8 high

EPSS

28%p98

Published

Mar 30, 2019 (Mar 30, 2019)

Modified

Jun 17, 2026

Description

Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to conduct SQL injection attacks via the sord parameter in a listCodeblueGroup API call to the /cgi? URI.

Vendors: grandstream
Products: ucm6204 firmware
Weakness: CWE-89
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (27.9%)

In the news0 stories

No ingested article mentions this CVE yet.