CVE-2020-36910

Cayin Signage Media Player 3.0 Authenticated Remote Command Injection via NTP Parameter

Published Jan 6, 2026 CVSS 4.0 · 8.7 High EPSS 1.4% KEV · Not listed
Description
Cayin Signage Media Player 3.0 contains an authenticated remote command injection vulnerability in system.cgi and wizard_system.cgi pages. Attackers can exploit the 'NTP_Server_IP' parameter with default credentials to execute arbitrary shell commands as root.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Cayintech
Cayintech smp-pro4
CPEs cpe:2.3:h:cayintech:smp-pro4:1.0:*:*:*:*:*:*:*
Vendors & Products Cayintech
Cayintech smp-pro4
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description Cayin Signage Media Player 3.0 contains an authenticated remote command injection vulnerability in system.cgi and wizard_system.cgi pages. Attackers can exploit the 'NTP_Server_IP' parameter with default credentials to execute arbitrary shell commands as root.
Title Cayin Signage Media Player 3.0 Authenticated Remote Command Injection via NTP Parameter
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
VulnCheck
Published
Updated
Jul 15, 2026, 1:24 AM
Reserved
Jan 3, 2026, 2:10 PM
Status
Deferred
Published
Jan 6, 2026, 4:15 PM
Modified
Jun 17, 2026, 3:16 AM