Inim Electronics S.R.L Smartliving Smartlan G Si vulnerabilities

CVE-2019-25289 [HIGH] CWE-78 CVE-2019-25289: SmartLiving SmartLAN <=6.x contains an authenticated remote command injection vulnerability in the w SmartLiving SmartLAN <=6.x contains an authenticated remote command injection vulnerability in the web.cgi binary through the 'par' POST parameter with the 'testemail' module. Attackers can exploit the unsanitized parameter and system() function call to execute arbitrary system commands with root privileges using default credentials.

CVE-2019-25291 [HIGH] CWE-798 CVE-2019-25291: INIM Electronics Smartliving SmartLAN/G/SI <=6.x contains hard-coded credentials in its Linux distri INIM Electronics Smartliving SmartLAN/G/SI <=6.x contains hard-coded credentials in its Linux distribution image that cannot be changed through normal device operations. Attackers can exploit these persistent credentials to log in and gain unauthorized system access across multiple SmartLiving device models.

CVE-2019-25290 [MEDIUM] CWE-918 CVE-2019-25290: Smartliving SmartLAN/G/SI <=6.x contains an unauthenticated server-side request forgery vulnerabilit Smartliving SmartLAN/G/SI <=6.x contains an unauthenticated server-side request forgery vulnerability in the GetImage functionality through the 'host' parameter. Attackers can exploit the onvif.cgi endpoint by specifying external domains to bypass firewalls and perform network enumeration through arbitrary HTTP requests.