CVE-2024-0840 json
Grandstream UCM Series IP PBX HTTP Parameter Injection
published 2024-04-29 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-16623
- cvss
- 8.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 59%
- public exploits
- 0
- none known
Summary
The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP request. Authentication may be possible using a default user and password. Affected models are the UCM6202, UCM6204, UCM6208, and UCM6510.
Patch / fix
- Grandstream UCM Series <1.0.20.52
- grandstream ucm6202_firmware 1.0.20.52
- grandstream ucm6204_firmware 1.0.20.52
- grandstream ucm6208_firmware 1.0.20.52
- grandstream ucm6510_firmware 1.0.20.52
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
0.88% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Grandstream UCM Series
- grandstream ucm6202_firmware
- grandstream ucm6204_firmware
- grandstream ucm6208_firmware
- grandstream ucm6510_firmware
Classification
- Weakness
-
- CWE-141 Improper Neutralization of Parameter/Argument Delimiters
References
Sources
- CVE List CVE-2024-0840
- NVD CVE-2024-0840
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.