CVE-2020-5722

The vulnerability present in the HTTP interface of the Grandstream UCM6200 series is characterized by an unauthenticated remote SQL injection flaw. This weakness allows an attacker to craft specific HTTP requests that can manipulate the underlying SQL database. By exploiting this vulnerability, an attacker can execute arbitrary SQL commands, potentially leading to unauthorized access to sensitive data or even full control over the device. The flaw is particularly severe due to its high CVSS score of 9.8, indicating critical risk, and affects versions prior to 1.0.19.20 and 1.0.20.17, which can lead to severe consequences if left unaddressed.

The attack vectors for this vulnerability are straightforward, as they require no authentication. An attacker can send specially crafted HTTP requests to the vulnerable device, which processes these requests without adequate input validation. This lack of validation allows the attacker to inject malicious SQL code into the database queries executed by the device. Exploitation scenarios could include retrieving sensitive information from the database, such as user credentials or configuration settings, or executing shell commands with root privileges. This could enable an attacker to manipulate the device's functionality, install malware, or pivot to other systems within the network.

The real-world impact of this vulnerability is significant, particularly for organizations relying on the Grandstream UCM6200 series for communication and telephony services. Successful exploitation could lead to data breaches, loss of confidentiality, and potential disruption of services. The ability to execute commands as root could allow attackers to alter configurations, leading to service outages or unauthorized access to sensitive communications. Furthermore, the injection of HTML into password recovery emails could facilitate phishing attacks, further compromising user accounts and organizational security. The business risks associated with such incidents include reputational damage, regulatory penalties, and financial losses due to remediation efforts and potential lawsuits.

To detect and mitigate this vulnerability, organizations should implement a multi-layered security approach. Regularly updating the firmware of the Grandstream UCM6200 series to the latest versions is crucial, as updates often contain patches for known vulnerabilities. Network monitoring tools can help identify unusual traffic patterns or unauthorized access attempts, providing early warning signs of potential exploitation. Additionally, employing web application firewalls (WAFs) can help filter out malicious requests before they reach the vulnerable interface. Organizations should also conduct regular security assessments and penetration testing to identify and remediate vulnerabilities proactively.

In conclusion, the unauthenticated remote SQL injection vulnerability in the Grandstream UCM6200 series poses a critical threat to organizations utilizing these devices. The ease of exploitation, coupled with the potential for severe consequences, necessitates immediate attention and action. By adopting robust detection and mitigation strategies, organizations can significantly reduce their risk exposure and protect their communication infrastructure from malicious actors.

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting the Grandstream UCM6200 series vulnerability CVE-2020-5722. While the EPSS score has slightly decreased, indicating a modest reduction in overall exploit likelihood, our telemetry reveals a sharp increase in active exploitation events. This divergence suggests that threat actors are intensifying targeted campaigns despite a broader decline in general exploit trends. The emergence of new proof-of-concept exploits and continued availability of Metasploit modules facilitate easier weaponization, increasing the risk of successful compromise. For defenders, this shift underscores the urgency of monitoring for exploitation indicators and reinforces the criticality of timely patching. The updated activity elevates the operational threat level, as adversaries demonstrate sustained interest and capability to leverage this vulnerability for remote code execution with root privileges, potentially enabling full system takeover.

Update 2 — July 06, 2026

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting CVE-2020-5722, reflected by a notable surge in telemetry activity. This increase corresponds with the continued availability and refinement of Metasploit modules and public proof-of-concept exploits, which lower the technical barrier for adversaries to execute remote code with root privileges on vulnerable Grandstream UCM6200 devices. Although the EPSS score shows a slight downward trend, the uptick in observed exploitation attempts signals sustained attacker interest and operational momentum. This evolving landscape elevates the threat level as it indicates adversaries are actively leveraging the vulnerability in the wild, increasing the likelihood of successful compromises. Defenders should be aware that the persistence and growth in exploitation activity underscore the criticality of vigilant monitoring and rapid incident response to mitigate potential impacts from full system takeover scenarios.