Description
COMMAX Smart Home System CDP-1020n contains an SQL injection vulnerability that allows attackers to bypass authentication by injecting arbitrary SQL code through the 'id' parameter in 'loginstart.asp'. Attackers can exploit this by sending a POST request with malicious 'id' values to manipulate database queries and gain unauthorized access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| COMMAX | Smart Home IoT Control System | CDP-1020n, 481 System | — |
References
- ExploitDB-50207 exploit
- Official Product Homepage product
- Zero Science Lab Disclosure (ZSL-2021-5662) third-party-advisory
- Zero Science GitHub Repository product
- VulnCheck Advisory: COMMAX Smart Home IoT Control System SQL Injection Authentication Bypass third-party-advisory