What is MS-ISAC?

The Multi-State Information Sharing and Analysis Center (MS-ISAC), funded by DHS, exists to improve the overall cybersecurity posture of state, local, tribal, and territorial governments and is designated as the key resource for cyber threat prevention, protection, response, and recovery.

New MS-ISAC Advisory

DATE(S) ISSUED:

04/08/2020

OVERVIEW:

The Grandstream UCM6200 Series is a IP PBX system or a communications solution used to unify communication technologies within a business such as voice, video calling, video conferencing, etc. Successful exploitation of this vulnerability could result in an attacker gaining the same privileges as the account running the HTTP service. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

THREAT INTELLIGENCE:

There currently exists a publicly available exploit for this vulnerability

RISK:

Government:

  • Large and medium government entities: High
  • Small government entities: High

Businesses:

  • Large and medium business entities: High
  • Small business entities: High

Home users: Low

RECOMMENDATIONS:

We recommend the following actions be taken:

  • Upgrading the firmware of vulnerable systems version 10.0.20.17 or newer
  • Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack.
  • Remind users not to visit websites or follow links provided by unknown or untrusted sources.
  • Inform and educate users regarding the threats posed by hypertext links contained in emails or attachments especially from un-trusted sources.
  • Apply the Principle of Least Privilege to all systems and services.

 

REFERENCES:

Grandstream:

http://www.grandstream.com/support/firmware/

Tenable:

https://www.tenable.com/security/research/tra-2020-15

https://www.tenable.com/cve/CVE-2020-5722

CVE:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-5722