Unencrypted Password Storage in UCM6200 Series by Grandstream
CVE-2020-5723

9.8CRITICAL

Key Information:

Vendor

Grandstream

Status
Grandstream Ucm6200 Series
Vendor
CVE Published:
30 March 2020

What is CVE-2020-5723?

The UCM6200 series of VoIP gateways by Grandstream has a significant weakness where user passwords are stored in an unencrypted format within an SQLite database. This security flaw could enable unauthorized individuals to easily access and extract all user passwords. As a result, attackers might obtain escalated privileges, compromising the integrity and confidentiality of the system. Users of the affected products are urged to update to newer versions to mitigate these risks.

Affected Version(s)

Grandstream UCM6200 series 1.0.20.20 and below

References

https://www.tenable.com/security/research/tra-2020-17
x_refsource_CONFIRM

EPSS Score

50% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.