PT-2026-1681 · Smartliving · Smartlan
CVE-2019-25289
·
Published
2026-01-07
·
Updated
2026-01-08
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
SmartLiving SmartLAN versions 6.x and earlier
Description
SmartLiving SmartLAN contains a remote command injection issue in the web.cgi binary. The issue is due to an unsanitized
par POST parameter within the 'testemail' module. An attacker can exploit this by using the system() function to execute arbitrary system commands with root privileges, potentially using default credentials.Recommendations
Versions prior to 6.x should be updated.
Exploit
Fix
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Smartlan