SQL Injection Vulnerability in Grandstream UCM6200 Series by Grandstream

CVE-2020-5725

What is CVE-2020-5725?

The Grandstream UCM6200 series devices, prior to version 1.0.20.22, are susceptible to an SQL injection vulnerability via the websockify endpoint in the HTTP server. This flaw allows a remote, unauthenticated attacker to exploit the login mechanism by transmitting a specially crafted username. Through sophisticated timing attacks, the attacker may successfully retrieve user passwords, potentially leading to unauthorized access and manipulation of sensitive data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References