Cayin Signage Media Player 3.0 Authenticated Remote Command Injection via NTP Parameter
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 1.3%
probabilidade de exploração
1.3%top 32% das CVEs
exploração observada
nãonenhuma fonte reporta
Cayin Signage Media Player 3.0 contains an authenticated remote command injection vulnerability in system.cgi and wizard_system.cgi pages. Attackers can exploit the 'NTP_Server_IP' parameter with default credentials to execute arbitrary shell commands as root.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
CAYIN Technology · SMP-1000CAYIN Technology · SMP-200CAYIN Technology · SMP-2000CAYIN Technology · SMP-2100CAYIN Technology · SMP-2200CAYIN Technology · SMP-2210CAYIN Technology · SMP-2300CAYIN Technology · SMP-2310CAYIN Technology · SMP-300CAYIN Technology · SMP-4000CAYIN Technology · SMP-6000CAYIN Technology · SMP-8000CAYIN Technology · SMP-8000QDCAYIN Technology · SMP-NEOCAYIN Technology · SMP-NEO2CAYIN Technology · SMP-PRO4CAYIN Technology · SMP-PROPLUSCAYIN Technology · SMP-WEB4CAYIN Technology · SMP-WEBPLUSReferências
https://cxsecurity.com/issue/WLB-2020060049https://exchange.xforce.ibmcloud.com/vulnerabilities/182924https://packetstorm.news/files/id/157942https://www.cayintech.comhttps://www.exploit-db.com/exploits/48557https://www.vulncheck.com/advisories/cayin-signage-media-player-authenticated-remote-command-injection-via-ntp-parameterhttps://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5569.php