GCVE - cpe:2.3:h:grandstream:ucm6208:-:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:h:grandstream:ucm6208:-:*:*:*:*:*:*:*

part: h version: - update: *

Vendor	Grandstream (`fb3509d2-60fb-591c-98b3-ccf7c0d07861`)
Product	Ucm6208 (`3a99bf6d-dec9-5871-b973-0dfe430b361a`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-5759`	not_vulnerable	2026-06-08 05:26:43.676640	Details available Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via SSH. An authenticated remote attacker can execute commands as the root user by issuing a specially crafted "unset" command. Published: 2020-07-17T20:35:51.000Z Updated: 2024-08-04T08:39:25.757Z Open on db.gcve.eu Reference links https://www.tenable.com/security/research/tra-2020-42	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-5758`	not_vulnerable	2026-06-08 05:26:43.675938	Details available Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. An authenticated remote attacker can execute commands as the root user by sending a crafted HTTP GET to the UCM's "Old" HTTPS API. Published: 2020-07-17T20:35:47.000Z Updated: 2024-08-04T08:39:25.723Z Open on db.gcve.eu Reference links https://www.tenable.com/security/research/tra-2020-42	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-5757`	not_vulnerable	2026-06-08 05:26:43.675210	Details available Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. An authenticated remote attacker can bypass command injection mitigations and execute commands as the root user by sending a crafted HTTP POST to the UCM's "New" HTTPS API. Published: 2020-07-17T20:35:44.000Z Updated: 2024-08-04T08:39:25.872Z Open on db.gcve.eu Reference links https://www.tenable.com/security/research/tra-2020-42	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-5726`	not_vulnerable	2026-06-08 05:26:43.581357	Details available The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the CTI server on port 8888. A remote unauthenticated attacker can invoke the challenge action with a crafted username and discover user passwords. Published: 2020-03-30T19:03:52.000Z Updated: 2024-08-04T08:39:25.691Z Open on db.gcve.eu Reference links https://www.tenable.com/security/research/tra-2020-17 http://packetstormsecurity.com/files/156977/Grandstream-UCM6200-Series-CTI-Interface-SQL-Injection.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-5725`	not_vulnerable	2026-06-08 05:26:43.580480	Details available The Grandstream UCM6200 series before 1.0.20.22 is vulnerable to an SQL injection via the HTTP server's websockify endpoint. A remote unauthenticated attacker can invoke the login action with a crafted username and, through the use of timing attacks, can discover user passwords. Published: 2020-03-30T19:03:44.000Z Updated: 2024-08-04T08:39:25.770Z Open on db.gcve.eu Reference links https://www.tenable.com/security/research/tra-2020-17 http://packetstormsecurity.com/files/156976/Grandstream-UCM6200-Series-WebSocket-1.0.20.20-SQL-Injection.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-5724`	not_vulnerable	2026-06-08 05:26:43.580008	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-5723`	not_vulnerable	2026-06-08 05:26:43.579446	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.