Grandstream UCM6204 up to 1.0.19 /cgi? backupUCMConfig command injection

Summaryinfo

A vulnerability was found in Grandstream UCM6204 up to 1.0.19. It has been declared as critical. This issue affects some unknown processing of the file /cgi?. The manipulation of the argument backupUCMConfig as part of Shell Metacharacter results in command injection. This vulnerability is reported as CVE-2019-10662. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Grandstream UCM6204 up to 1.0.19. Affected is some unknown processing of the file /cgi?. The manipulation of the argument backupUCMConfig as part of a Shell Metacharacter leads to a command injection vulnerability. CWE is classifying the issue as CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the backupUCMConfig file-backup parameter to the /cgi? URI.

The bug was discovered 03/22/2019. The weakness was disclosed 03/30/2019. This vulnerability is traded as CVE-2019-10662 since 03/30/2019. It is possible to launch the attack remotely. Required for exploitation is a authentication. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1202 by the MITRE ATT&CK project.

The vulnerability was handled as a non-public zero-day exploit for at least 8 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 1.0.19.20 eliminates this vulnerability.

The entry VDB-132643 is pretty similar. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Grandstream

Name

• UCM6204

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.0.7
• 1.0.8
• 1.0.9
• 1.0.10
• 1.0.11
• 1.0.12
• 1.0.13
• 1.0.14
• 1.0.15
• 1.0.16
• 1.0.17
• 1.0.18
• 1.0.19

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion