CVE-2024-0840

published 2024-04-29

CVE-2024-0840: The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and…

Priority P2 64 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP request. Authentication may be possible using a default user and password. Affected models are the UCM6202, UCM6204, UCM6208, and UCM6510.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
gnu	binutils	>= 0 < 2.34-6ubuntu1.10	2.34-6ubuntu1.10
gnu	binutils	>= 0 < 2.38-4ubuntu2.7	2.38-4ubuntu2.7
gnu	binutils	>= 0 < 2.42-4ubuntu2.4	2.42-4ubuntu2.4
grandstream	ucm_series	< <1.0.20.52	<1.0.20.52

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

osv 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-141