CVE-2024-0840

Grandstream UCM Series IP PBX HTTP Parameter Injection

View on CVE.org

Published Apr 29, 2024 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Description

The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP request. Authentication may be possible using a default user and password. Affected models are the UCM6202, UCM6204, UCM6208, and UCM6510.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Grandstream

UCM Series

unaffected

Version	Status	Constraints
`0`	affected	< <1.0.20.52

No data.

No data.

No data available yet.

Remediation

Vendor Solution

Upgrade to firmware version 1.0.20.52 or later. Ensure the web interface is not exposed to the internet.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2024-16623	The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP request. Authentication may be possible using a default user and password. Affected models are the UCM6202, UCM6204, UCM6208, and UCM6510.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.880% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://vulncheck.com/advisories/grand-stream-param-injection

History

No history.

Subscriptions

No data.

Weaknesses

CWE-141

Sources

CVE record Updated: Aug 1, 2024, 6:18 PM

Status: PUBLISHED
Assigner: VulnCheck
Published: Apr 29, 2024, 6:42 PM
Updated: Aug 1, 2024, 6:18 PM
Reserved: Jan 23, 2024, 9:10 PM

View source JSON

Vulnrichment Updated: Aug 1, 2024, 6:18 PM

Updated: Aug 1, 2024, 6:18 PM

NVD Updated: Jun 17, 2026, 6:54 AM

Status: Deferred
Published: Apr 29, 2024, 7:15 PM
Modified: Jun 17, 2026, 6:54 AM

View source JSON

Red Hat No data

No data.

OpenCVE enrichment No data

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-0840", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2024-01-23T21:10:19.364Z", "datePublished": "2024-04-29T18:42:57.112Z", "dateUpdated": "2024-08-01T18:18:18.719Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "UCM Series", "vendor": "Grandstream", "versions": [{"lessThan": "<1.0.20.52", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Jacob Baines (VulnCheck)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP request. Authentication may be possible using a default user and password. Affected models are the UCM6202, UCM6204, UCM6208, and UCM6510.<br>"}], "value": "The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP request. Authentication may be possible using a default user and password. Affected models are the UCM6202, UCM6204, UCM6208, and UCM6510.\n"}], "impacts": [{"capecId": "CAPEC-137", "descriptions": [{"lang": "en", "value": "CAPEC-137 Parameter Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-141", "description": "CWE-141 Improper Neutralization of Parameter/Argument Delimiters", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2024-04-29T18:42:57.112Z"}, "references": [{"url": "https://vulncheck.com/advisories/grand-stream-param-injection"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Upgrade to firmware version 1.0.20.52 or later. Ensure the web interface is not exposed to the internet.<br>"}], "value": "Upgrade to firmware version 1.0.20.52 or later. Ensure the web interface is not exposed to the internet.\n"}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2024-01-25T17:00:00.000Z", "value": "VulnCheck reports the vulnerability to Grandstream"}, {"lang": "en", "time": "2024-01-26T02:00:00.000Z", "value": "Grandstream acknowledges receipt"}, {"lang": "en", "time": "2024-02-08T04:42:00.000Z", "value": "Grandstream shares a patch build"}, {"lang": "en", "time": "2024-04-26T04:11:00.000Z", "value": "Grandstream releases 1.0.20.52"}], "title": "Grandstream UCM Series IP PBX HTTP Parameter Injection", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "grandstream", "product": "ucm6202_firmware", "cpes": ["cpe:2.3:a:grandstream:ucm6202_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "1.0.20.52", "versionType": "custom"}]}, {"vendor": "grandstream", "product": "ucm6204_firmware", "cpes": ["cpe:2.3:a:grandstream:ucm6204_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "1.0.20.52", "versionType": "custom"}]}, {"vendor": "grandstream", "product": "ucm6208_firmware", "cpes": ["cpe:2.3:a:grandstream:ucm6208_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "1.0.20.52", "versionType": "custom"}]}, {"vendor": "grandstream", "product": "ucm6510_firmware", "cpes": ["cpe:2.3:a:grandstream:ucm6510_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "1.0.20.52", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-05-01T19:17:53.854809Z", "id": "CVE-2024-0840", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-06T13:09:24.386Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:18:18.719Z"}, "title": "CVE Program Container", "references": [{"url": "https://vulncheck.com/advisories/grand-stream-param-injection", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://vulncheck.com/advisories/grand-stream-param-injection", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:18:18.719Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-0840", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-01T19:17:53.854809Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:grandstream:ucm6202_firmware:*:*:*:*:*:*:*:*"], "vendor": "grandstream", "product": "ucm6202_firmware", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.20.52", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:grandstream:ucm6204_firmware:*:*:*:*:*:*:*:*"], "vendor": "grandstream", "product": "ucm6204_firmware", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.20.52", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:grandstream:ucm6208_firmware:*:*:*:*:*:*:*:*"], "vendor": "grandstream", "product": "ucm6208_firmware", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.20.52", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:grandstream:ucm6510_firmware:*:*:*:*:*:*:*:*"], "vendor": "grandstream", "product": "ucm6510_firmware", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.20.52", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-01T19:13:22.175Z"}}], "cna": {"title": "Grandstream UCM Series IP PBX HTTP Parameter Injection", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Jacob Baines (VulnCheck)"}], "impacts": [{"capecId": "CAPEC-137", "descriptions": [{"lang": "en", "value": "CAPEC-137 Parameter Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Grandstream", "product": "UCM Series", "versions": [{"status": "affected", "version": "0", "lessThan": "<1.0.20.52", "versionType": "custom"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2024-01-25T17:00:00.000Z", "value": "VulnCheck reports the vulnerability to Grandstream"}, {"lang": "en", "time": "2024-01-26T02:00:00.000Z", "value": "Grandstream acknowledges receipt"}, {"lang": "en", "time": "2024-02-08T04:42:00.000Z", "value": "Grandstream shares a patch build"}, {"lang": "en", "time": "2024-04-26T04:11:00.000Z", "value": "Grandstream releases 1.0.20.52"}], "solutions": [{"lang": "en", "value": "Upgrade to firmware version 1.0.20.52 or later. Ensure the web interface is not exposed to the internet.\n", "supportingMedia": [{"type": "text/html", "value": "Upgrade to firmware version 1.0.20.52 or later. Ensure the web interface is not exposed to the internet.<br>", "base64": false}]}], "references": [{"url": "https://vulncheck.com/advisories/grand-stream-param-injection"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP request. Authentication may be possible using a default user and password. Affected models are the UCM6202, UCM6204, UCM6208, and UCM6510.\n", "supportingMedia": [{"type": "text/html", "value": "The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP request. Authentication may be possible using a default user and password. Affected models are the UCM6202, UCM6204, UCM6208, and UCM6510.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-141", "description": "CWE-141 Improper Neutralization of Parameter/Argument Delimiters"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2024-04-29T18:42:57.112Z"}}}, "cveMetadata": {"cveId": "CVE-2024-0840", "state": "PUBLISHED", "dateUpdated": "2024-08-01T18:18:18.719Z", "dateReserved": "2024-01-23T21:10:19.364Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2024-04-29T18:42:57.112Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "UCM Series", "vendor": "Grandstream", "versions": [{"lessThan": "<1.0.20.52", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}, {"affectedData": [{"cpes": ["cpe:2.3:a:grandstream:ucm6202_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "ucm6202_firmware", "vendor": "grandstream", "versions": [{"lessThan": "1.0.20.52", "status": "affected", "version": "0", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:a:grandstream:ucm6204_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "ucm6204_firmware", "vendor": "grandstream", "versions": [{"lessThan": "1.0.20.52", "status": "affected", "version": "0", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:a:grandstream:ucm6208_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "ucm6208_firmware", "vendor": "grandstream", "versions": [{"lessThan": "1.0.20.52", "status": "affected", "version": "0", "versionType": "custom"}]}, {"cpes": ["cpe:2.3:a:grandstream:ucm6510_firmware:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "ucm6510_firmware", "vendor": "grandstream", "versions": [{"lessThan": "1.0.20.52", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP request. Authentication may be possible using a default user and password. Affected models are the UCM6202, UCM6204, UCM6208, and UCM6510.\n"}, {"lang": "es", "value": "La central IP Grandstream UCM Series anterior a la versi\u00f3n de firmware 1.0.20.52 se ve afectada por una vulnerabilidad de inyecci\u00f3n de par\u00e1metros en la interfaz HTTP. Un atacante remoto y autenticado puede ejecutar c\u00f3digo arbitrario enviando una solicitud HTTP manipulada. La autenticaci\u00f3n puede ser posible utilizando un usuario y una contrase\u00f1a predeterminados. Los modelos afectados son UCM6202, UCM6204, UCM6208 y UCM6510."}], "id": "CVE-2024-0840", "lastModified": "2026-06-17T06:54:24.887", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-0840", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-05-01T19:17:53.854809Z", "version": "2.0.3"}}]}, "published": "2024-04-29T19:15:19.730", "references": [{"source": "disclosure@vulncheck.com", "url": "https://vulncheck.com/advisories/grand-stream-param-injection"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://vulncheck.com/advisories/grand-stream-param-injection"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-141"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}