---
id: "CVE-2020-5722"
kind: "vulnerability"
aliases: ["CVE-2020-5722"]
title: "Grandstream UCM6200: Grandstream Networks UCM6200 Series SQL Injection Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.84406
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Grandstream UCM6200", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "grandstream", "infrastructure", "self-hosted", "ucm6200", "voip"]
not_affected_if: ["not-exposed-to-network", "other-grandstream-models"]
published_at: "2020-03-23T20:15:12+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-5722", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-5722", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5722", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Grandstream UCM6200: Grandstream Networks UCM6200 Series SQL Injection Vulnerability

Grandstream UCM6200 series VoIP PBX appliances have an unauthenticated SQL injection flaw triggered by a crafted HTTP request. An attacker can execute code as root on the device.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Grandstream UCM6200 affected ? fixed ?

## How to check

Identify UCM6200 series units on the network and compare firmware version against the vendor advisory; sources do not give a version check command.

## Fix

Apply the firmware update per Grandstream vendor instructions; sources do not name the fixed version.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-5722
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-5722
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-5722

## From the sources

The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_