Grandstream UCM Series IP PBX Vulnerable to Parameter Injection Attack

CVE-2024-0840

What is CVE-2024-0840?

The Grandstream UCM Series IP PBX, prior to firmware version 1.0.20.52, is impacted by a parameter injection vulnerability within its HTTP interface. This flaw enables remote and authenticated attackers to execute arbitrary code by issuing specially crafted HTTP requests. Authentication may be compromised through default credentials. Critical vulnerabilities such as this underscore the importance of timely updates and close monitoring of affected models, including UCM6202, UCM6204, UCM6208, and UCM6510.

References