PT-2021-10707 · Inim Electronics · Inim Electronics Smartliving Smartlan/G/Si

Gjoko Krstic · Published 2021-04-29 · Updated 2021-05-12 · CVE-2020-21992

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Inim Electronics SmartLiving SmartLAN/G/SI versions prior to 7.x

Description: The issue exists due to the par POST parameter not being sanitized when called with the testemail module through the web.cgi binary. This allows for OS command injection with root privileges through the mailx service. An attacker can remotely execute system commands as the root user using default credentials and bypass access controls in place.

Recommendations: For Inim Electronics SmartLiving SmartLAN/G/SI versions prior to 7.x, consider disabling the testemail module until a patch is available to prevent exploitation of the command injection vulnerability. Restrict access to the web.cgi binary to minimize the risk of exploitation. Avoid using the par parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-21992

Affected Products

Inim Electronics Smartliving Smartlan/G/Si

References · 3

• 🔥 https://zeroscience.mk/en/vulnerabilities/ZSL-2019-5544.php · Exploit
• https://osv.dev/vulnerability/CVE-2020-21992 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-21992 · Security Note