PT-2020-18679
CVE-2020-5758
·
تاريخ النشر
2020-07-17
·
تاريخ التحديث
2020-07-23
الوصف من
CVSS 2.0
9.0
عاليةالمقاييسAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions
Grandstream UCM6200 series firmware version 1.0.20.23 and below
Description
The issue allows an authenticated remote attacker to execute commands as the root user by sending a crafted HTTP GET to the UCM's "Old" HTTPS API, specifically via HTTP. This is an OS command injection vulnerability.
Recommendations
For Grandstream UCM6200 series firmware version 1.0.20.23 and below, update to a version above 1.0.20.23 to resolve the issue. As a temporary workaround, consider restricting access to the "Old" HTTPS API to minimize the risk of exploitation.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾