What the vulnerability does

01Description

Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via SSH. An authenticated remote attacker can execute commands as the root user by issuing a specially crafted "unset" command.

Key dates

02Disclosure timeline

July 17, 2020 CVE published
August 4, 2024 Record updated