CVE-2020-5722
Grandstream Networks UCM6200 Series SQL Injection Vulnerability
Description
CVE-2020-5722 is a CRITICAL SQL injection vulnerability (CWE-89) affecting the Grandstream UCM6200 series IP PBX systems running firmware versions prior to 1.0.19.20. The flaw allows an unauthenticated remote attacker to inject malicious SQL commands via specially crafted HTTP requests to the device's web interface, ultimately achieving arbitrary code execution with root privileges on the underlying operating system. With a CVSS 3.1 score of 9.8, this vulnerability requires no authentication, no user interaction, and can be exploited remotely over the network with low attack complexity. CISA added CVE-2020-5722 to its Known Exploited Vulnerabilities catalog on January 28, 2022, with a remediation deadline of July 28, 2022. The EPSS score of 0.92735 (99.75th percentile) reflects an extremely high probability of active exploitation in the wild, underscoring the urgency of patching affected devices.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| grandstream | ucm6200 firmware | < 1.0.19.20 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/156876/UCM6202-1.0.18.13-Remote-Command-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/165708/Grandstream-UCM62xx-IP-PBX-sendPasswordEmail-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://www.tenable.com/security/research/tra-2020-15(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5722(US Government Resource)
Weakness Type
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
SQL Injection is one of the most well-known and dangerous vulnerability classes in software security. It occurs when an application constructs SQL queries by directly incorporating user-supplied input without proper sanitization or parameterization. Attackers exploit this by injecting malicious SQL syntax through input fields, URL parameters, HTTP headers, or cookies, causing the database to execute unintended commands. The consequences range from unauthorized data access and modification to complete database compromise and, in some configurations, operating system command execution. SQL Injection has been responsible for some of the largest data breaches in history and consistently ranks among the top web application security risks according to OWASP.
In the Grandstream UCM6200 series, the SQL injection vulnerability manifests in the device's web interface, which processes HTTP requests without adequately neutralizing special SQL elements in user-supplied parameters. Because the UCM6200 is an IP PBX system that manages telecommunications for organizations, the underlying database contains sensitive call records, user credentials, voicemail data, and network configuration details. The lack of input validation allows an unauthenticated attacker to craft HTTP requests that manipulate SQL queries, bypassing authentication entirely and gaining the ability to execute arbitrary commands as root on the device. Learn more about SQL Injection (CWE-89)
Impact Analysis
CVE-2020-5722 carries a CVSS 3.1 base score of 9.8 (CRITICAL), reflecting the maximum severity across all impact dimensions with minimal prerequisites for exploitation.
Confidentiality (High): Successful SQL injection on the UCM6200 grants the attacker unrestricted access to all data stored in the device's database. This includes call detail records containing information about every call routed through the PBX, user credentials and authentication tokens, voicemail recordings, SIP account configurations, and internal network topology details. Since exploitation leads to root-level code execution, the attacker can also read any file on the device's filesystem, including encryption keys and certificates used for secure communications.
Integrity (High): An attacker can modify any data within the database, including altering call routing rules to redirect calls, inserting backdoor accounts for persistent access, manipulating voicemail messages, or changing SIP trunk configurations to intercept communications. With root-level command execution, the attacker can modify system binaries, install persistent malware, alter logging to conceal evidence of compromise, and change device firmware to maintain long-term control over the PBX system.
Availability (High): The attacker can disrupt the entire PBX infrastructure by deleting critical database tables, corrupting firmware, or intentionally misconfiguring routing rules. Since the UCM6200 handles all voice communications for the organization, a denial-of-service attack on this device effectively shuts down the organization's telephone system, impacting both internal and external communications.
Scope (Unchanged): While the scope is technically unchanged in the CVSS assessment, root-level access to the PBX system provides a network foothold that can be leveraged to attack other systems on the same network segment. The EPSS score of 0.92735 (99.75th percentile) confirms near-certain exploitation activity, making immediate remediation essential.
Exploit Maturity
Active Exploitation: CVE-2020-5722 has been confirmed as actively exploited in the wild. CISA added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog on January 28, 2022, mandating that federal agencies remediate it by July 28, 2022. The inclusion in the KEV catalog is based on reliable evidence of active exploitation by threat actors targeting internet-facing PBX systems.
Ransomware Association: CISA's KEV catalog does not associate CVE-2020-5722 with known ransomware campaigns. However, the root-level access achievable through this vulnerability could readily be leveraged by ransomware operators seeking initial network access through exposed network devices.
Public Exploits: Multiple public exploit modules are available for this vulnerability. Packet Storm Security hosts detailed exploit code for the UCM6202 remote command injection and Grandstream UCM62xx remote code execution. Additionally, Tenable published detailed security research (TRA-2020-15) documenting the vulnerability mechanics and exploitation methodology.
EPSS Context: The EPSS score of 0.92735 (99.75th percentile) indicates that this vulnerability ranks in the top 0.25% of all CVEs for exploitation likelihood, reflecting both the availability of public exploits and confirmed in-the-wild activity.
KEV Deadline: Federal agencies were required to remediate by July 28, 2022. Organizations outside the federal sector should treat this deadline as a strong recommendation for prioritized patching.
Remediation
-
Update Grandstream UCM6200 firmware to version 1.0.19.20 or later. Download and install the latest firmware from the official Grandstream support portal. This update addresses the SQL injection vulnerability by implementing proper input sanitization in the web interface's HTTP request processing.
-
Restrict network access to the UCM6200 web management interface. Place the PBX system behind a firewall and limit access to the administrative web interface to trusted internal IP addresses only. Disable any port forwarding rules that expose the management interface to the public internet, as the vulnerability can be exploited remotely without authentication.
-
Audit the device for signs of prior compromise. Review system logs for unusual HTTP requests targeting the web interface, unexpected administrative account creation, modifications to call routing configurations, or evidence of outbound connections to unknown IP addresses. If compromise is suspected, perform a factory reset and restore from a known-good backup after applying the firmware update.
-
Rotate all credentials stored on the device. Change all SIP account passwords, administrative credentials, voicemail PINs, and any shared secrets or certificates configured on the UCM6200. If the device was compromised, assume all stored credentials have been exfiltrated by the attacker.
-
Implement network segmentation for voice infrastructure. Place PBX systems and SIP endpoints on a dedicated VLAN separated from general-purpose workstations and servers. Apply strict access control lists to limit cross-segment communication to only the protocols and ports required for voice services.
-
Deploy a web application firewall or intrusion prevention system. Configure WAF or IPS rules to detect and block SQL injection attempts targeting the UCM6200 web interface as an additional layer of defense. Monitor alerts for exploitation attempts to maintain situational awareness.
Technical Details
CVE-2020-5722 is an unauthenticated SQL injection vulnerability in the web management interface of the Grandstream UCM6200 series IP PBX systems. The vulnerable firmware versions prior to 1.0.19.20 fail to properly sanitize user-supplied input in HTTP request parameters before incorporating them into SQL queries executed against the device's internal database. This allows an attacker to inject arbitrary SQL syntax that alters the intended query logic.
The attack requires no authentication and can be launched remotely over the network (AV:N/AC:L/PR:N/UI:N). The attacker crafts HTTP requests containing SQL injection payloads in specific parameters processed by the web interface. Because the database engine on the UCM6200 runs with elevated privileges, successful SQL injection not only provides full database access but also enables operating system command execution through database features, achieving root-level code execution on the underlying Linux system.
The root cause is a classic failure to implement parameterized queries or prepared statements in the web application code. Instead, the application constructs SQL query strings by concatenating user input directly, allowing attackers to break out of the intended query context and execute arbitrary SQL commands. The Tenable research team documented the exploitation chain in TRA-2020-15, demonstrating how the SQL injection in the sendPasswordEmail function can be chained to achieve full remote code execution.
The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the worst-case scenario: a network-accessible vulnerability with no prerequisites that achieves complete compromise of confidentiality, integrity, and availability on the target device.
Frequently Asked Questions
What is CVE-2020-5722?
CVE-2020-5722 is a critical SQL injection vulnerability in the Grandstream UCM6200 series IP PBX systems. It allows unauthenticated remote attackers to inject malicious SQL commands via the device's web interface, ultimately achieving arbitrary code execution with root privileges. The vulnerability affects firmware versions prior to 1.0.19.20 and carries a CVSS 3.1 score of 9.8 (CRITICAL).
Which Grandstream products are affected by CVE-2020-5722?
The vulnerability affects the Grandstream UCM6200 series running firmware versions below 1.0.19.20. This includes models such as the UCM6202, UCM6204, and UCM6208 IP PBX systems. Organizations using any UCM6200 series device with outdated firmware should update immediately, particularly if the web management interface is accessible from untrusted networks.
How do I fix CVE-2020-5722?
Update the UCM6200 firmware to version 1.0.19.20 or later, which patches the SQL injection vulnerability. Additionally, restrict network access to the web management interface to trusted IP addresses only, and ensure the device is not directly exposed to the internet. After patching, audit the device for signs of prior compromise and rotate all stored credentials as a precaution.
How severe is CVE-2020-5722?
CVE-2020-5722 is rated CRITICAL with a CVSS 3.1 score of 9.8, the near-maximum severity rating. Its EPSS score of 0.92735 places it in the 99.75th percentile for exploitation probability. CISA has confirmed active exploitation and included it in the Known Exploited Vulnerabilities catalog. The vulnerability requires no authentication and enables remote root-level code execution, making it one of the most dangerous vulnerabilities affecting IP PBX systems.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.