PT-2020-18678
CVE-2020-5757
·
تاريخ النشر
2020-07-17
·
تاريخ التحديث
2020-07-23
الوصف من
CVSS 3.1
10
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Grandstream UCM6200 series firmware version 1.0.20.23 and below
Description
The issue allows an authenticated remote attacker to execute commands as the root user by sending a crafted HTTP POST to the "New" HTTPS API, bypassing command injection mitigations.
Recommendations
For Grandstream UCM6200 series firmware version 1.0.20.23 and below, consider restricting access to the "New" HTTPS API until a patch is available. As a temporary workaround, limit the privileges of the root user to minimize the risk of exploitation.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾