CVE-2020-7357
Published: Aug 6, 2020
Modified: Sep 17, 2024
CVSS v3.1
9.6
Description
Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user through the 'NTP_Server_IP' HTTP POST parameter in system.cgi page. This issue affects several branches and versions of the CMS application, including CME-SE, CMS-60, CMS-40, CMS-20, and CMS version 8.2, 8.0, and 7.5.
| Vendor | Product | Versions |
|---|---|---|
Cayin Technology | Cayin CMS-SE | affected 11.0 Build 19179 - <= 11.0 Build 19179 |
Cayin Technology | Cayin CMS-60 | affected 11.0 Build 19025 - <= 11.0 Build 19025 |
Cayin Technology | Cayin CMS-40 | affected 9.0 Build 14917 - <= 9.0 Build 14917 |
Cayin Technology | Cayin CMS-20 | affected 9.0 Build 14917 - <= 9.0 Build 14917 |
Cayin Technology | Cayin CMS | affected 8.2 Build 12199affected 8.0 Build 11175affected 7.5 Build 11175 |
Weaknesses (CWE)
CVSS v3.1 Details
CVSS v3.1 Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now