CVE-2020-5757
Severity Score
9.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. An authenticated remote attacker can bypass command injection mitigations and execute commands as the root user by sending a crafted HTTP POST to the UCM's "New" HTTPS API.
Grandstream serie UCM6200 versiones de firmware 1.0.20.23 y posterior, es vulnerable a una inyección de comandos del Sistema Operativo por medio de HTTP. Un atacante autenticado remoto puede omitir las mitigaciones de inyección de comandos y ejecutar comandos como usuario root mediante el envío de un HTTP POST diseñado hacia la API HTTPS "New" de UCM
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2020-01-06 CVE Reserved
- 2020-07-17 CVE Published
- 2024-08-04 CVE Updated
- 2024-10-12 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://www.tenable.com/cve/CVE-2020-5757 | Third Party Advisory | |
| https://www.tenable.com/security/research/tra-2020-42 | Not Applicable |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Grandstream Search vendor "Grandstream" | Ucm6202 Firmware Search vendor "Grandstream" for product "Ucm6202 Firmware" | <= 1.0.20.23 Search vendor "Grandstream" for product "Ucm6202 Firmware" and version " <= 1.0.20.23" | - |
Affected
| in | Grandstream Search vendor "Grandstream" | Ucm6202 Search vendor "Grandstream" for product "Ucm6202" | - | - |
Safe
|
| Grandstream Search vendor "Grandstream" | Ucm6204 Firmware Search vendor "Grandstream" for product "Ucm6204 Firmware" | <= 1.0.20.23 Search vendor "Grandstream" for product "Ucm6204 Firmware" and version " <= 1.0.20.23" | - |
Affected
| in | Grandstream Search vendor "Grandstream" | Ucm6204 Search vendor "Grandstream" for product "Ucm6204" | - | - |
Safe
|
| Grandstream Search vendor "Grandstream" | Ucm6208 Firmware Search vendor "Grandstream" for product "Ucm6208 Firmware" | <= 1.0.20.23 Search vendor "Grandstream" for product "Ucm6208 Firmware" and version " <= 1.0.20.23" | - |
Affected
| in | Grandstream Search vendor "Grandstream" | Ucm6208 Search vendor "Grandstream" for product "Ucm6208" | - | - |
Safe
|