Vulnerability Database

296,147

Total vulnerabilities in the database

CVE-2020-7357

Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user through the 'NTP_Server_IP' HTTP POST parameter in system.cgi page. This issue affects several branches and versions of the CMS application, including CME-SE, CMS-60, CMS-40, CMS-20, and CMS version 8.2, 8.0, and 7.5.

  • Published: Aug 6, 2020
  • Updated: Apr 14, 2023
  • CVE: CVE-2020-7357
  • Severity: Critical
  • Exploit:

CVSS v3:

  • Severity: Critical
  • Score: 9.9
  • AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVSS v2:

  • Severity: High
  • Score: 9
  • AV:N/AC:L/Au:S/C:C/I:C/A:C

CWEs:

OWASP TOP 10:

Software From Fixed in
cayintech / cms-se_firmware 11.0-19179 11.0-19179.x
cayintech / cms-se_firmware 11.0-19025 11.0-19025.x
cayintech / cms-se_firmware 11.0-18325 11.0-18325.x
cayintech / cms-60_firmware 11.0-19025 11.0-19025.x
cayintech / cms-40_firmware 9.0-14197 9.0-14197.x
cayintech / cms-40_firmware 9.0-14199 9.0-14199.x
cayintech / cms-40_firmware 9.0-14093 9.0-14093.x
cayintech / cms-20_firmware 9.0-14197 9.0-14197.x
cayintech / cms-20_firmware 9.0-14092 9.0-14092.x
cayintech / cms 7.5-11175 7.5-11175.x
cayintech / cms 8.0-11175 8.0-11175.x
cayintech / cms 8.2-12199 8.2-12199.x