{"id":"CVE-2020-5722","kind":"vulnerability","aliases":["CVE-2020-5722"],"related":[],"title":"Grandstream UCM6200: Grandstream Networks UCM6200 Series SQL Injection Vulnerability","description":"The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17.","summary":"Grandstream UCM6200 series VoIP PBX appliances have an unauthenticated SQL injection flaw triggered by a crafted HTTP request. An attacker can execute code as root on the device.","severity":"critical","cvss":10.0,"epss":0.84406,"exploited":true,"exploited_at":"2022-01-28T00:00:00+00:00","products":[{"name":"Grandstream UCM6200","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","grandstream","infrastructure","self-hosted","ucm6200","voip"],"not_affected_if":["not-exposed-to-network","other-grandstream-models"],"how_to_check":"Identify UCM6200 series units on the network and compare firmware version against the vendor advisory; sources do not give a version check command.","fix":"Apply the firmware update per Grandstream vendor instructions; sources do not name the fixed version.","status":"open","published_at":"2020-03-23T20:15:12+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:29:01+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T21:29:01Z","model":"claude-haiku-5-5","output":{"fix":"Apply the firmware update per Grandstream vendor instructions; sources do not name the fixed version.","reach":"internet","impact":"high","summary":"Grandstream UCM6200 series VoIP PBX appliances have an unauthenticated SQL injection flaw triggered by a crafted HTTP request. An attacker can execute code as root on the device.","category":"infrastructure","who_cares":["grandstream","ucm6200","voip","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker runs code as root on the PBX.","analyst_note":"Find the fixed firmware version and affected model list in the Grandstream advisory for CVE-2020-5722; CISA KEV entry confirms active exploitation.","how_to_check":"Identify UCM6200 series units on the network and compare firmware version against the vendor advisory; sources do not give a version check command.","needs_analyst":true,"not_affected_if":["other-grandstream-models","not-exposed-to-network"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00048,"input_tokens":2847,"output_tokens":391,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2020':11A,14A '-5722':12A,15A '1.0.19.20':89C '1.0.20.17':100C 'applianc':31B 'attack':45B,75C 'code':48B 'command':83C 'craft':41B,71C 'cve':10A,13A 'devic':53B 'email':96C 'execut':47B,81C 'exploit':18B 'flaw':37B 'grandstream':1A,3A,16A,19B,26B,59C 'host':23B 'html':92C 'http':42B,55C,72C 'infrastructur':20B 'inject':8A,36B,69C,91C 'interfac':56C 'network':4A 'password':94C 'pbx':30B 'recoveri':95C 'remot':67C 'request':43B,73C 'root':50B,85C 'self':22B 'self-host':21B 'seri':6A,28B,61C 'shell':82C 'sql':7A,35B,68C 'trigger':38B 'ucm6200':2A,5A,17A,24B,27B,60C 'unauthent':34B,66C 'use':77C 'version':87C,98C 'via':70C 'voip':25B,29B 'vulner':9A,63C,79C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2020-03-23T20:15:12+00:00","kev":{"dateAdded":"2022-01-28","dueDate":"2022-07-28","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2020-5722","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-5722","severity":null,"published_at":"2022-01-28T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T16:39:49+00:00","note":null},{"source":"epss","external_id":"CVE-2020-5722","url":"https://api.first.org/data/v1/epss?cve=CVE-2020-5722","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2020-5722","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5722","severity":null,"published_at":"2020-03-23T20:15:12+00:00","modified_at":"2026-06-17T03:22:06+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}