Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the backupUCMConfig file-backup parameter to the /cgi? URI.

Multiple Vulnerabilities in Grandstream devices.

   - The affected devices are: GAC2500, GVC3202, GXP2200,      GXV3275, GXV3240, GXV3611IR_HD, GXV3611IR_HD, GXV3611IR_HD,      UCM6204, GXV3370, & WP820.

   - A remote command execution vulnerability exists in the 'priority'      and 'logserver' parameters. An unauthenticated, remote attacker can exploit      them to bypass authentication and execute arbitrary commands      with root privileges. 

   - A blind command injection vulnerability exists in the      'file-backup' parameter. An unauthenticated, remote attacker can      exploit this to bypass authentication and obtain a root shell.

The remote host is running a Grandstream UCM6204 IP PBX, firmware version prior to 1.0.19.20, and is therefore affected by a RCE attack vector. An attacker can exploit a blind command injection vulnerability in the "file-backup" parameter of the 'backupUCMConfig' API call allowing the execution of arbitrary code. (CVE-2019-10662) A vulnerability allows remote authenticated users to conduct SQL injection attacks via the sord parameter in a listCodeblueGroup API call to the '/cgi?' URI. (CVE-2019-10663)

Multiple Vulnerabilities in Grandstream devices.

   - The affected devices are: GAC2500, GVC3202, GXP2200,      GXV3275, GXV3240, GXV3611IR_HD, GXV3611IR_HD, GXV3611IR_HD,      UCM6204, GXV3370, WP820, GWN7000, & GWN7610.

   - A remote command execution vulnerability exists in the 'priority'      and 'logserver' parameters. An unauthenticated, remote attacker can exploit      them to bypass authentication and execute arbitrary commands      with root privileges.

   - A blind command injection vulnerability exists in the 'filename'      and 'file-backup' parameters. An unauthenticated, remote      attacker can exploit this to bypass authentication and obtain a root shell.

ID	Name	Product	Family	Severity
124173	Multiple Command Injection Vulnerabilities in Grandstream Products	Nessus	Misc.	critical
700492	Grandstream IP PBX Appliance UCM6204 < 1.0.19.20 RCE	Nessus Network Monitor	IoT	high
123520	Multiple Command Injection Vulnerabilities in Grandstream Products	Nessus	Misc.	critical

Detections

Analytics

CVE-2019-10662

high

Tenable Plugins

critical

high

critical