CVE-2020-5726

PoC —

CVSS 3.1

7.5 high

EPSS

4%p91

Published

Mar 30, 2020 (Mar 30, 2020)

Modified

Jun 17, 2026

Description

The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888. A remote unauthenticated attacker can invoke the challenge action with a crafted username and discover user passwords.

Vendors: grandstream
Products: ucm6202 firmware, ucm6204 firmware, ucm6208 firmware
Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (4.3%)

In the news0 stories

No ingested article mentions this CVE yet.