Description
Cayin Signage Media Player 3.0 contains an authenticated remote command injection vulnerability in system.cgi and wizard_system.cgi pages. Attackers can exploit the 'NTP_Server_IP' parameter with default credentials to execute arbitrary shell commands as root.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CAYIN Technology | SMP-8000QD | 3.0 | — |
| CAYIN Technology | SMP-8000 | 3.0 | — |
| CAYIN Technology | SMP-6000 | 3.0 Build 19025, 1.0 Build 14246, 1.0 Build 14199, 1.0 Build 14167, 1.0 Build 14097, 1.0 Build 14090, 1.0 Build 14069, 1.0 Build 14062 | — |
| CAYIN Technology | SMP-4000 | 1.0 Build 14098, 1.0 Build 14092, 1.0 Build 14087 | — |
| CAYIN Technology | SMP-2310 | 3.0 | — |
| CAYIN Technology | SMP-2300 | 3.0 Build 19316 | — |
| CAYIN Technology | SMP-2210 | 3.0 Build 19025 | — |
| CAYIN Technology | SMP-2200 | 3.0 Build 19029, 3.0 Build 19025 | — |
| CAYIN Technology | SMP-2100 | 10.0 Build 16228, 3.0 | — |
| CAYIN Technology | SMP-2000 | 1.0 Build 14167, 1.0 Build 14087 | — |
| CAYIN Technology | SMP-1000 | 1.0 Build 14099 | — |
| CAYIN Technology | SMP-PROPLUS | 1.5 Build 10081 | — |
| CAYIN Technology | SMP-WEBPLUS | 6.5 Build 11126 | — |
| CAYIN Technology | SMP-WEB4 | 2.0 Build 13073, 2.0 Build 11175, 1.5 Build 11476, 1.5 Build 11126, 1.0 Build 10301 | — |
| CAYIN Technology | SMP-300 | 1.0 Build 14177 | — |
| CAYIN Technology | SMP-200 | 1.0 Build 13080, 1.0 Build 12331 | — |
| CAYIN Technology | SMP-PRO4 | 1.0 | — |
| CAYIN Technology | SMP-NEO2 | 1.0 | — |
| CAYIN Technology | SMP-NEO | 1.0 | — |
References
- ExploitDB-48557 exploit
- Cayin Technology Official Website product
- Zero Science Lab Disclosure (ZSL-2020-5569) third-party-advisory
- Packet Storm Security Exploit Entry exploit
- IBM X-Force Vulnerability Exchange vdb-entry
- CXSecurity Vulnerability Listing exploit
- VulnCheck Advisory: Cayin Signage Media Player 3.0 Authenticated Remote Command Injection via NTP Parameter third-party-advisory