Products
Grandstream UCM Series IP PBX
- before firmware version 1.0.20.52
Source
disclosure@vulncheck.com
Tags
CVE-2024-0840 details
Published : April 29, 2024, 7:15 p.m.
Last Modified : April 29, 2024, 7:15 p.m.
Last Modified : April 29, 2024, 7:15 p.m.
Description
The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP request. Authentication may be possible using a default user and password. Affected models are the UCM6202, UCM6204, UCM6208, and UCM6510.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8.8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Base Score
8.8
Exploitability Score
Impact Score
Base Severity
HIGH
Vector String : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
| URL | Source |
|---|---|
| https://vulncheck.com/advisories/grand-stream-param-injection | disclosure@vulncheck.com |
This website uses the NVD API, but is not approved or certified by it.