title: Cayin CMS Command Injection
description: Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user through the 'NTP_Server_IP' HTTP POST parameter in system.cgi page. This issue affects several branches and versions of the CMS application, including CME-SE, CMS-60, CMS-40, CMS-20, and CMS version 8.2, 8.0, and 7.5.
problem types: CWE-78 OS Command Injection
affected:
{
product: Cayin CMS-SE
vendor: Cayin Technology
versions:
lessThanOrEqual: 11.0 Build 19179, status: affected, version: 11.0 Build 19179, versionType: custom
}
{
product: Cayin CMS-60
vendor: Cayin Technology
versions:
lessThanOrEqual: 11.0 Build 19025, status: affected, version: 11.0 Build 19025, versionType: custom
}
{
product: Cayin CMS-40
vendor: Cayin Technology
versions:
lessThanOrEqual: 9.0 Build 14917, status: affected, version: 9.0 Build 14917, versionType: custom
}
{
product: Cayin CMS-20
vendor: Cayin Technology
versions:
lessThanOrEqual: 9.0 Build 14917, status: affected, version: 9.0 Build 14917, versionType: custom
}
{
product: Cayin CMS
vendor: Cayin Technology
versions:
status: affected, version: 8.2 Build 12199
status: affected, version: 8.0 Build 11175
status: affected, version: 7.5 Build 11175
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
version: 3.1
]