CVE-2024-0840

Published: Apr 29, 2024Modified: Jun 17, 2026Deferred

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: disclosure@vulncheck.com (Secondary)

Description

The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP request. Authentication may be possible using a default user and password. Affected models are the UCM6202, UCM6204, UCM6208, and UCM6510.

Related CWEs

CWE-141

Improper Neutralization of Parameter/Argument Delimiters

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as parameter or argument delimiters when they are sent to a downstream component.

References (2)

https://vulncheck.com/advisories/grand-stream-param-injection

Source: disclosure@vulncheck.com

https://vulncheck.com/advisories/grand-stream-param-injection

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.