← CVE Intelligence

CVE-2020-36910

Cayin Signage Media Player 3.0 Authenticated Remote Command Injection via NTP Parameter PUBLISHED

Description (CNA)

Cayin Signage Media Player 3.0 contains an authenticated remote command injection vulnerability in system.cgi and wizard_system.cgi pages. Attackers can exploit the 'NTP_Server_IP' parameter with default credentials to execute arbitrary shell commands as root.

Affected (CNA)

Vendor / productVersions
CAYIN Technology / SMP-8000QDaffected 3.0
CAYIN Technology / SMP-8000affected 3.0
CAYIN Technology / SMP-6000affected 3.0 Build 19025; affected 1.0 Build 14246; affected 1.0 Build 14199; affected 1.0 Build 14167; affected 1.0 Build 14097; affected 1.0 Build 14090; affected 1.0 Build 14069; affected 1.0 Build 14062
CAYIN Technology / SMP-4000affected 1.0 Build 14098; affected 1.0 Build 14092; affected 1.0 Build 14087
CAYIN Technology / SMP-2310affected 3.0
CAYIN Technology / SMP-2300affected 3.0 Build 19316
CAYIN Technology / SMP-2210affected 3.0 Build 19025
CAYIN Technology / SMP-2200affected 3.0 Build 19029; affected 3.0 Build 19025
CAYIN Technology / SMP-2100affected 10.0 Build 16228; affected 3.0
CAYIN Technology / SMP-2000affected 1.0 Build 14167; affected 1.0 Build 14087
CAYIN Technology / SMP-1000affected 1.0 Build 14099
CAYIN Technology / SMP-PROPLUSaffected 1.5 Build 10081
CAYIN Technology / SMP-WEBPLUSaffected 6.5 Build 11126
CAYIN Technology / SMP-WEB4affected 2.0 Build 13073; affected 2.0 Build 11175; affected 1.5 Build 11476; affected 1.5 Build 11126; affected 1.0 Build 10301
CAYIN Technology / SMP-300affected 1.0 Build 14177
CAYIN Technology / SMP-200affected 1.0 Build 13080; affected 1.0 Build 12331
CAYIN Technology / SMP-PRO4affected 1.0
CAYIN Technology / SMP-NEO2affected 1.0
CAYIN Technology / SMP-NEOaffected 1.0

CWE

CWE-78

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.