PT-2026-1445 · Cayin · Cayin Signage Media Player

Published 2026-01-06 · Updated 2026-01-06 · CVE-2020-36910

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cayin Signage Media Player version 3.0

Description The software contains an authenticated remote command injection issue in the system.cgi and wizard system.cgi pages. An attacker can exploit the NTP Server IP parameter using default credentials to execute arbitrary shell commands as root.

Recommendations Apply any available updates to address the issue in the system.cgi and wizard system.cgi pages. Change the default credentials to prevent unauthorized access. Restrict access to the system.cgi and wizard system.cgi pages. As a temporary workaround, avoid using the NTP Server IP parameter.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-36910

Affected Products

Cayin Signage Media Player

References · 9

• 🔥 https://cxsecurity.com/issue/WLB-2020060049 · Exploit
• 🔥 https://exploit-db.com/exploits/48557 · Exploit
• 🔥 https://packetstorm.news/files/id/157942 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-36910 · Security Note
• https://vulncheck.com/advisories/cayin-signage-media-player-authenticated-remote-command-injection-via-ntp-parameter · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/182924 · Note
• https://zeroscience.mk/en/vulnerabilities/ZSL-2020-5569.php · Note
• https://cayintech.com · Note
• https://t.me/cveNotify/147863 · Telegram Post