Is CVE-2020-5722 (Grandstream Networks UCM6200 Series SQL Injection) being exploited in the wild?

What Exploitation in the Wild Means for CVE-2020-5722

CVE-2020-5722 is not just a theoretical SQL injection issue, because CISA placed it in the Known Exploited Vulnerabilities catalogue on 28 January 2022. For defenders, that means the question is exposure, not abstract severity: if you run Grandstream UCM6200 series systems, assume the vulnerability is attractive to attackers and treat it as an active threat path rather than a dormant bug.

The practical takeaway is that KEV status changes prioritisation. If the product is reachable from the internet or sits on a network segment that an attacker can reach after initial access, it should move ahead of ordinary backlog work. That is especially true for unauthenticated SQL injection, because exploitation can begin with a single crafted HTTP request and may not require prior account compromise.

The fact that CISA has not linked this CVE to known ransomware campaigns matters less than the KEV listing itself. In operational terms, confirmed exploitation means the window for safe delay is already gone, so the response should focus on exposure reduction, fix verification, and compromise checks rather than waiting for a broader campaign signal.

How to Confirm Exposure and Reduce Attack Surface

First, establish whether any Grandstream UCM6200 series systems exist in your environment, including lab, branch, or forgotten edge deployments. Then confirm whether the vulnerable management interface or related HTTP service is reachable from untrusted networks, because internet exposure or broad internal reachability materially raises the likelihood of opportunistic abuse.

Once you identify a live instance, apply the vendor remediation guidance and compare it with the CISA KEV entry for the authoritative due date and action. Where a fix cannot be applied immediately, isolate the system, restrict inbound access to only the smallest operational set, and remove any unnecessary public exposure or cross-segment access paths that make exploitation easier.

Because this is SQL injection, the attack surface is not just the product itself, but also anything downstream that the appliance can query or influence. That means backup systems, account stores, logging destinations, and adjacent administrative interfaces should all be considered when you judge blast radius.

What to Check If Patching Has to Wait

If remediation must be delayed, treat the system as potentially targetable and look for signs that someone has already tried to exploit it. Review web access logs, proxy logs, firewall events, and any application or appliance logs for unusual request patterns, repeated parameter tampering, odd query strings, or requests that hit management endpoints from unexpected sources.

Use the delay to assess whether the device stores or exposes sensitive configuration, call routing data, credentials, or other administrative material that an attacker could reach after successful injection. If the appliance participates in broader voice or communications workflows, verify whether compromise could be used as a pivot into adjacent systems or as a foothold for service disruption.

When there is any doubt about prior compromise, preserve logs and volatile evidence before making disruptive changes. For this type of flaw, a patch alone is not always enough if the attacker may already have used the injection point to read data or alter configuration.

Risk and Threat Considerations

Unauthenticated SQL injection creates a direct path from external request to backend data access, and KEV inclusion means that path has already been observed in the wild. The main risk is not only data exposure, but also configuration tampering, credential theft, and persistence through altered application state or stored changes.

Failure mechanism: A crafted HTTP request reaches vulnerable backend query logic, allowing the attacker to manipulate database queries without valid credentials and potentially read or modify sensitive records.

Impact: Attackers can exfiltrate data, weaken the appliance’s configuration, pivot into connected systems, or disrupt communications services, especially where the device is exposed to broad network access.

Practitioner Guidance

What to prioritise: Treat KEV-listed, unauthenticated vulnerabilities as emergency work, especially on edge appliances that sit in front of business-critical services. If the device is externally reachable, remediation and exposure reduction should come before routine maintenance.

What to verify: Confirm the exact product family, management exposure, and whether any suspicious requests or unexplained configuration changes occurred before remediation. If the system handles sensitive communications or administrative data, validate whether those stores were reachable through the injection path.

Practitioner takeaway: For a KEV-listed SQL injection, the key question is not whether exploitation is possible, but whether you have already reduced exposure and ruled out pre-remediation compromise.

Related resources from NHI Mgmt Group

• Guide: Zero-Day and Exploited Vulnerabilities Guide
• How do you patch or mitigate CVE-2020-5722 (Grandstream Networks UCM6200 Series SQL Injection)?
• CVE-2020-5722 (Grandstream Networks UCM6200 Series SQL Injection)
• Is CVE-2024-9465 (Palo Alto Networks Expedition SQL Injection) being exploited in the wild?
• Is CVE-2024-29824 (Ivanti Endpoint Manager (EPM) SQL Injection) being exploited in the wild?