Remote Command Injection in SmartLiving SmartLAN by Inim
CVE-2019-25289

8.7HIGH

Key Information:

Vendor: Inim Electronics S.r.l.
Status: Smartliving Smartlan/g/si
Vendor: CVE Published:; 7 January 2026

🔔 Create Inim Electronics S.r.l. Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2019-25289?

The SmartLiving SmartLAN versions up to 6.x are affected by a significant security vulnerability that allows authenticated users to execute arbitrary commands on the system. This vulnerability arises from the 'par' POST parameter within the web.cgi binary, specifically through the 'testemail' module. Attackers can exploit this weakness due to improper sanitization of the input, leveraging a vulnerable system() function call. If default credentials are used, this breach can lead to full root access, making it critical for users to secure their devices against potential exploitation.

Affected Version(s)

SmartLiving SmartLAN/G/SI <=6.x <= 6.x

SmartLiving SmartLAN/G/SI 505

SmartLiving SmartLAN/G/SI 515

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2019-25289 - Proof of Concept