Cayin Signage Media Player 3.0 Authenticated Remote Command Injection via NTP Parameter
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 1.3%
probabilidad de explotación
1.3%top 32% de las CVE
explotación observada
noninguna fuente lo reporta
Cayin Signage Media Player 3.0 contains an authenticated remote command injection vulnerability in system.cgi and wizard_system.cgi pages. Attackers can exploit the 'NTP_Server_IP' parameter with default credentials to execute arbitrary shell commands as root.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
CAYIN Technology · SMP-1000CAYIN Technology · SMP-200CAYIN Technology · SMP-2000CAYIN Technology · SMP-2100CAYIN Technology · SMP-2200CAYIN Technology · SMP-2210CAYIN Technology · SMP-2300CAYIN Technology · SMP-2310CAYIN Technology · SMP-300CAYIN Technology · SMP-4000CAYIN Technology · SMP-6000CAYIN Technology · SMP-8000CAYIN Technology · SMP-8000QDCAYIN Technology · SMP-NEOCAYIN Technology · SMP-NEO2CAYIN Technology · SMP-PRO4CAYIN Technology · SMP-PROPLUSCAYIN Technology · SMP-WEB4CAYIN Technology · SMP-WEBPLUSReferencias
https://cxsecurity.com/issue/WLB-2020060049https://exchange.xforce.ibmcloud.com/vulnerabilities/182924https://packetstorm.news/files/id/157942https://www.cayintech.comhttps://www.exploit-db.com/exploits/48557https://www.vulncheck.com/advisories/cayin-signage-media-player-authenticated-remote-command-injection-via-ntp-parameterhttps://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5569.php