Live › vulnerability › CVE-2020-5722
Go to dashboardGrandstream UCM6200 series VoIP PBX appliances have an unauthenticated SQL injection flaw triggered by a crafted HTTP request. An attacker can execute code as root on the device.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Grandstream UCM6200 | vendor | – | – |
Identify UCM6200 series units on the network and compare firmware version against the vendor advisory; sources do not give a version check command.
Apply the firmware update per Grandstream vendor instructions; sources do not name the fixed version.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17.
This page as .md · .json · in your agent: get_signal("CVE-2020-5722")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.