High severity8.8NVD Advisory· Published Jan 8, 2026· Updated Apr 15, 2026

CVE-2019-25289

Description

SmartLiving SmartLAN <=6.x contains an authenticated remote command injection vulnerability in the web.cgi binary through the 'par' POST parameter with the 'testemail' module. Attackers can exploit the unsanitized parameter and system() function call to execute arbitrary system commands with root privileges using default credentials.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Patches

Vulnerability mechanics

References

cxsecurity.com/issue/WLB-2019120046nvd
exchange.xforce.ibmcloud.com/vulnerabilities/172840nvd
packetstormsecurity.com/files/155616nvd
www.exploit-db.com/exploits/47765nvd
www.inim.biznvd
www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5544.phpnvd

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000