Vulnerability · Published Apr 29, 2024 · Assigned by VulnCheck
CVE-2024-0840Grandstream UCM Series IP PBX HTTP Parameter Injection
High 8.8
In plain English
A high-severity security flaw in UCM Series from Grandstream. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Official description
The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP request. Authentication may be possible using a default user and password. Affected models are the UCM6202, UCM6204, UCM6208, and UCM6510.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Grandstream | UCM Series | 0 – before <1.0.20.52 |
Weakness: CWE-141 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H