CVE-2020-5725

CVE-2020-5725 describes an SQL injection vulnerability in Grandstream UCM6200 series IP PBX devices running firmware versions prior to 1.0.20.22. This flaw allows a remote, unauthenticated attacker to exploit the websockify endpoint to conduct timing attacks and potentially discover user passwords. Rated as Medium severity (CVSS 5.9), the attack requires high complexity but can lead to high confidentiality impact without user interaction. While no public exploit code or active exploitation has been observed, and community discussion is minimal, organizations using affected Grandstream devices should prioritize patching.