PT-2026-1681 · Smartliving · Smartlan

Published 2026-01-07 · Updated 2026-01-08 · CVE-2019-25289

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SmartLiving SmartLAN versions 6.x and earlier

Description SmartLiving SmartLAN contains a remote command injection issue in the web.cgi binary. The issue is due to an unsanitized par POST parameter within the 'testemail' module. An attacker can exploit this by using the system() function to execute arbitrary system commands with root privileges, potentially using default credentials.

Recommendations Versions prior to 6.x should be updated.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-25289

Affected Products

Smartlan

References · 8

• 🔥 https://packetstormsecurity.com/files/155616 · Exploit
• 🔥 https://exploit-db.com/exploits/47765 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25289 · Security Note
• https://inim.biz · Note
• https://t.me/CVEtracker/41645 · Telegram Post
• https://zeroscience.mk/en/vulnerabilities/ZSL-2019-5544.php · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/172840 · Note
• https://cxsecurity.com/issue/WLB-2019120046 · Note