CVE-2020-21992
Estado: ModificadaAlta (8.8)—
Inim Electronics SmartLiving SmartLAN/G/SI <=6.x suffers from an authenticated remote command injection vulnerability. The issue exist due to the 'par' POST parameter not being sanitized when called with the 'testemail' module through web.cgi binary. The vulnerable CGI binary (ELF 32-bit LSB executable, ARM) is calling the 'sh' executable via the system() function to issue a command using the mailx service and its vulnerable string format parameter allowing for OS command injection with root privileges. An attacker can remotely execute system commands as the root user using default credentials and bypass access controls in place.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 8.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 5.21%
- Percentil entre todas las CVEs puntuadas: 92
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (6)
CWE
- CWE-78
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2020-21992",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 9,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"authentication": "SINGLE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.8,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2021-04-29T15:15:10.443",
"references": [
{
"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5544.php",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5544.php",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-78"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Inim Electronics SmartLiving SmartLAN/G/SI <=6.x suffers from an authenticated remote command injection vulnerability. The issue exist due to the 'par' POST parameter not being sanitized when called with the 'testemail' module through web.cgi binary. The vulnerable CGI binary (ELF 32-bit LSB executable, ARM) is calling the 'sh' executable via the system() function to issue a command using the mailx service and its vulnerable string format parameter allowing for OS command injection with root privileges. An attacker can remotely execute system commands as the root user using default credentials and bypass access controls in place."
},
{
"lang": "es",
"value": "Inim Electronics SmartLiving SmartLAN/G/SI versiones anteriores a 6.x incluyéndola, sufre una vulnerabilidad de inyección de comando remoto autenticado. El problema se presenta debido a que el parámetro POST \"par\" no está siendo saneado cuando se llama con el módulo \"testemail\" por medio del binario web.cgi. El binario CGI vulnerable (ejecutable ELF LSB de 32 bits, ARM) está llamando al ejecutable \"sh\" por medio de la función system() para emitir un comando usando el servicio mailx y su parámetro de formato de cadena vulnerable que permite la inyección de comandos del Sistema Operativo con privilegios root. Un atacante puede ejecutar comandos del sistema de forma remota como usuario root usando las credenciales predeterminadas y omitir los controles de acceso en su lugar"
}
],
"lastModified": "2026-06-17T03:04:01.427",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:inim:smartliving_505_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1D6EB9DE-4537-4070-9AAB-197FAD04313C",
"versionEndIncluding": "6.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:inim:smartliving_505:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "30FE3762-2144-4DF6-89C1-2181E15ACCF4"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:inim:smartliving_515_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "72CEA623-65E8-4F0B-87C0-615ED5C47269",
"versionEndIncluding": "6.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:inim:smartliving_515:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1EBA5461-77FB-46E5-BFDC-F470A9A97492"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:inim:smartliving_1050_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E9ACAF85-F4BD-4751-ACA5-0ADE339C82A3",
"versionEndIncluding": "6.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:inim:smartliving_1050:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1BB1029D-DC9C-444A-BCE3-AF1BE074A068"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:inim:smartliving_1050g3_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "945C2E70-72F7-4EF6-BFBC-CFDA43FC6DE0",
"versionEndIncluding": "6.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:inim:smartliving_1050g3:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "0BF688BA-60F1-4F19-8CFA-6C1EFB4D4128"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:inim:smartliving_10100l_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "270CD713-574B-4A14-A002-275CD3C7EF86",
"versionEndIncluding": "6.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:inim:smartliving_10100l:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "5537E090-43C2-42B1-A793-23E765A82D6E"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:inim:smartliving_10100lg3_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E3F59BB8-E7D0-4B3A-A05F-CD78B9510DA0",
"versionEndIncluding": "6.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:inim:smartliving_10100lg3:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "108A7416-7196-49E8-9181-CE27C9F1ED11"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "cve@mitre.org"
}