CVE-2019-25289
INIM Electronics SmartLiving SmartLAN/G/SI <=6.x Remote Command Execution
- State
- Published
- Severity
- 8.7 High
- Published
- Jan 7, 2026
- Updated
- Mar 23, 2026
- Reserved
- Jan 6, 2026
Description
SmartLiving SmartLAN <=6.x contains an authenticated remote command injection vulnerability in the web.cgi binary through the 'par' POST parameter with the 'testemail' module. Attackers can exploit the unsanitized parameter and system() function call to execute arbitrary system commands with root privileges using default credentials.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
| Product | Versions |
|---|---|
SmartLiving SmartLAN/G/SIINIM Electronics s.r.l. |
|
References
- Zero Science Lab Vulnerability Advisorythird-party-advisory
- Exploit Database Entry 47765exploit
- Packet Storm Security Exploit Fileexploit
- CXSecurity Vulnerability Issuethird-party-advisory
- IBM X-Force Vulnerability Exchange Entryvdb-entry
- Inim Vendor Homepageproduct
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.