Hard-Coded Credential Vulnerability in INIM Electronics Smartliving Products
CVE-2019-25291

9.3CRITICAL

Key Information:

Vendor

Inim Electronics S.r.l.

Status
Smartliving Smartlan/g/si
Vendor
CVE Published:
7 January 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2019-25291?

The INIM Electronics Smartliving SmartLAN/G/SI devices, running Linux versions up to 6.x, contain hard-coded credentials that are unchangeable through regular device operations. This vulnerability allows malicious actors to exploit these persistent credentials, facilitating unauthorized access to the system across various models of SmartLiving devices. As a result, attackers can gain complete control over the affected systems, leading to potential data breaches and further exploitation.

Affected Version(s)

Smartliving SmartLAN/G/SI <=6.x <= 6.x

Smartliving SmartLAN/G/SI 505

Smartliving SmartLAN/G/SI 515

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2019-25291 - Proof of Concept

CVE-2019-25291 - Proof of Concept

References

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-55...
third-party-advisory
https://www.exploit-db.com/exploits/47763
exploit
https://packetstormsecurity.com/files/155618
exploit

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

LiquidWorm as Gjoko Krstic of Zero Science Lab
JSON
.
CVE-2019-25291 : Hard-Coded Credential Vulnerability in INIM Electronics Smartliving Products