How severe is CVE-2024-0840?

CVE-2024-0840 has a CVSS 3.x base score of 8.8, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2024-0840 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (55th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2024-0840?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2024-0840 have an EU (EUVD) identifier?

Yes. CVE-2024-0840 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-16623.

When was CVE-2024-0840 published?

CVE-2024-0840 was published on 2024-04-29 and last updated on 2026-06-17.

CVE-2024-0840

CVE-2024-0840 is a high-severity vulnerability with a CVSS 3.x base score of 8.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-141.

Key facts

Severity: High (CVSS 3.x base score 8.8)
EPSS exploit prediction: 1% (55th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-16623
Weakness: CWE-141
Published: 2024-04-29
Last modified: 2026-06-17

Description

The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP request. Authentication may be possible using a default user and password. Affected models are the UCM6202, UCM6204, UCM6208, and UCM6510.

Frequently asked questions

What is CVE-2024-0840?: The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP request. Authentication may be possible using a default user and password. Affected models are the UCM6202, UCM6204, UCM6208, and UCM6510.
How severe is CVE-2024-0840?: CVE-2024-0840 has a CVSS 3.x base score of 8.8, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2024-0840 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (55th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2024-0840?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2024-0840 have an EU (EUVD) identifier?: Yes. CVE-2024-0840 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-16623.
When was CVE-2024-0840 published?: CVE-2024-0840 was published on 2024-04-29 and last updated on 2026-06-17.

References

https://vulncheck.com/advisories/grand-stream-param-injection

Other CWE-141 vulnerabilities

CVE-2023-28815 — Critical (CVSS 9.8): Some versions of Hikvision's iSecure Center Product contain insufficient parameter validation, resulting in a command…
CVE-2022-41665 — Critical (CVSS 9.8): A vulnerability has been identified in SICAM P850 (7KG8500-0AA00-0AA0) (All versions < V3.10), SICAM P850…
CVE-2022-29873 — Critical (CVSS 9.8): A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate…
CVE-2020-7868 — Critical (CVSS 9.6): A remote code execution vulnerability exists in helpUS(remote administration tool) due to improper validation of…
CVE-2025-31329 — Medium (CVSS 6.2): SAP NetWeaver is vulnerable to an Information Disclosure vulnerability caused by the injection of malicious…
CVE-2025-20338 — Medium (CVSS 6.0): A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with administrative…

Browse all CWE-141 vulnerabilities →