Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U H H H 9.8 .8441 99.7 YES
AFFECTED Product Versions Fixed Grandstream UCM6200 Series Before 1.0.20.17 – —
TIMELINE Jan 6 Reserved by tenable Mar 23 Published (CNA: tenable) Jan 28 Added to CISA KEV, remediation due 2022-07-28
The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker can use this vulnerability to execute shell commands as root on versions before 1.0.19.20 or inject HTML in password recovery emails in versions before 1.0.20.17.
| Date | Event | Detail |
|---|---|---|
| January 6, 2020 | Reserved | Reserved by tenable |
| March 23, 2020 | Published | Published (CNA: tenable) |
| January 28, 2022 | KEV ADDED | Added to CISA KEV, remediation due 2022-07-28 |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| n/a | Grandstream UCM6200 Series | — | Before 1.0.20.17 | — |
Authoritative record: CVE-2020-5722 at cve.org
Weaknesses: CWE-89
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2020-5722 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
