CVE-2024-0840 - CVE House
Back to Database
Status published High CVE-2024-0840

Grandstream UCM Series IP PBX HTTP Parameter Injection

Vulnerability Description

The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP request. Authentication may be possible using a default user and password. Affected models are the UCM6202, UCM6204, UCM6208, and UCM6510.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-0840

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Jacob Baines (VulnCheck)

References

More from Grandstream

View All →
CVE-2025-14186
Grandstream GXP1625 Network Status api.values.post cross site scripting
Medium 5.1
CVE-2024-32937
An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone...
High 8.1
CVE-2022-2070
Grandstream GSD3710 Stack-based Buffer Overflow
Critical 9.8
CVE-2022-2025
Grandstream GSD3710 Stack-based Buffer Overflow
Critical 9.8

Affected Vendor

Grandstream

View all reports →

Affected Software

UCM Series
Vulnerable Versions:
0

Timeline

Official Publish: April 29th, 2024
Last Modified: August 1st, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-141

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.