CVE-2020-7357
Critical
Description
Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user through the 'NTP_Server_IP' HTTP POST parameter in system.cgi page. This issue affects several branches and versions of the CMS application, including CME-SE, CMS-60, CMS-40, CMS-20, and CMS version 8.2, 8.0, and 7.5.
SeverityCritical
CVSS9.6
Exploit probability—
ProductCayintech Cms-60 Firmware
PublishedAug 6, 2020
First seenAug 6, 2020
Weakness typeCWE-78OS command injection
How to fix
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cayintech cms-60_firmware | 11.0 | — |
| cayintech cms-se_firmware | 11.0 | — |
| cayintech cms-se-lxc_firmware | No range specified | — |
| cayintech cms-40_firmware | 9.0 | — |
| cayintech cms-20_firmware | 9.0 | — |
| cayintech cms | 7.5, 8.0, 8.2 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.