{"id":"CVE-2020-5722","published":"2020-03-23T20:15:12Z","modified":"2026-06-17T03:22:06Z","title":"Grandstream Networks UCM6200 Series SQL Injection Vulnerability","vendor":"Grandstream","product":"UCM6200","tier":"core","eol":null,"description":{"text":"The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17.","provenance":"source","from":"NVD"},"summary":{"text":"The Grandstream UCM6200 series has a SQL injection flaw in its HTTP interface, which is reachable over the network. An unauthenticated attacker who sends a crafted HTTP request can execute shell commands as root on versions before 1.0.19.20, or inject HTML into password recovery emails on versions before 1.0.20.17, with no authentication or user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:36:04Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.84287,"percentile":0.99698,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2022-01-28","dueDate":"2022-07-28","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-5722","provenance":"source"},"vulncheckKev":{"dateAdded":"2020-04-03","exploitedFirstSeen":"2020-04-03","ransomware":false,"evidence":[{"url":"https://unit42.paloaltonetworks.com/new-hoaxcalls-ddos-botnet/","date":"2020-04-03"},{"url":"https://www.radware.com/security/ddos-threats-attacks/threat-advisories-attack-reports/hoaxcalls-evolution/","date":"2020-04-21"},{"url":"https://blog.radware.com/security/botnets/2020/05/whos-viktor-tracking-down-the-xtc-polaris-botnets/","date":"2020-05-07"},{"url":"https://blog.radware.com/security/botnets/2020/05/ghosting-bots-the-story-of-hoaxcalls-failures/","date":"2020-05-28"},{"url":"https://blog.netlab.360.com/ddos-botnet-moobot-en/","date":"2020-07-09"},{"url":"https://unit42.paloaltonetworks.com/iot-vulnerabilities-mirai-payloads/","date":"2020-10-14"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-01-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-05&host_type=src&vulnerability=cve-2020-5722","date":"2024-01-05"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-12-31&host_type=src&vulnerability=cve-2020-5722","date":"2024-12-31"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-01-04&host_type=src&vulnerability=cve-2020-5722","date":"2025-01-04"}],"evidenceTotal":19,"provenance":"source"},"exploited":true,"otx":null,"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"http://packetstormsecurity.com/files/156876/UCM6202-1.0.18.13-Remote-Command-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165708/Grandstream-UCM62xx-IP-PBX-sendPasswordEmail-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.tenable.com/security/research/tra-2020-15","tags":["Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/156876/UCM6202-1.0.18.13-Remote-Command-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/165708/Grandstream-UCM62xx-IP-PBX-sendPasswordEmail-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.tenable.com/security/research/tra-2020-15","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5722","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated SQL injection over HTTP targets public-facing app","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"unauthenticated remote SQL injection via crafted HTTP request","start":73,"end":134}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Shell command execution as root is direct impact","mappingType":"primary_impact","evidence":[{"from":"description","quote":"execute shell commands as root","start":178,"end":208}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-26881","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-26881","exploited":true,"exploitedSince":"2022-01-28","provenance":"source"},"exploits":[{"id":48247,"url":"https://www.exploit-db.com/exploits/48247","title":"UCM6202 1.0.18.13 - Remote Command Injection","type":"webapps","platform":"hardware","date":"2020-03-24","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2020-03-24"},"metasploit":[{"name":"Grandstream UCM62xx IP PBX sendPasswordEmail RCE","module":"exploit/linux/http/grandstream_ucm62xx_sendemail_rce","type":"exploit","disclosureDate":"2020-03-23","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/grandstream_ucm62xx_sendemail_rce.rb"}],"nuclei":[{"id":"CVE-2020-5722","name":"Grandstream UCM6200 - SQL Injection","severity":"critical","path":"http/cves/2020/CVE-2020-5722.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-5722.yaml"}],"first":{"date":"2020-03-23","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/grandstream_ucm62xx_sendemail_rce.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/156876/UCM6202-1.0.18.13-Remote-Command-Injection.html","http://packetstormsecurity.com/files/165708/Grandstream-UCM62xx-IP-PBX-sendPasswordEmail-Remote-Code-Execution.html","https://www.tenable.com/security/research/tra-2020-15"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2020-03-23","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-5722","provenance":"source"},{"date":"2020-03-23","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2020-03-24","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/grandstream_ucm62xx_sendemail_rce.rb","provenance":"source"},{"date":"2020-04-03","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://unit42.paloaltonetworks.com/new-hoaxcalls-ddos-botnet/","provenance":"source"},{"date":"2022-01-28","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-01-28","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-26881","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":676},"priority":{"score":66.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2403 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.94,"detail":"percentile 0.9970"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 1 Exploit-DB entry; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}