CVE-2019-25289

published 2026-01-08

CVE-2019-25289: SmartLiving SmartLAN <=6.x contains an authenticated remote command injection vulnerability in the web.cgi binary through the 'par' POST parameter with the…

Priority P2 70 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

SmartLiving SmartLAN <=6.x contains an authenticated remote command injection vulnerability in the web.cgi binary through the 'par' POST parameter with the 'testemail' module. Attackers can exploit the unsanitized parameter and system() function call to execute arbitrary system commands with root privileges using default credentials.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
inim_electronics_s.r.l	smartliving_smartlan_g_si	—	—
inim_electronics_s.r.l	smartliving_smartlan_g_si	—	—
inim_electronics_s.r.l	smartliving_smartlan_g_si	—	—
inim_electronics_s.r.l	smartliving_smartlan_g_si	—	—
inim_electronics_s.r.l	smartliving_smartlan_g_si	—	—
inim_electronics_s.r.l	smartliving_smartlan_g_si	—	—
inim_electronics_s.r.l	smartliving_smartlan_g_si	—	—

CVSS provenance

nvd v3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78