High severity8.8NVD Advisory· Published Jan 8, 2026· Updated Apr 15, 2026

CVE-2019-25289

Description

SmartLiving SmartLAN <=6.x contains an authenticated remote command injection vulnerability in the web.cgi binary through the 'par' POST parameter with the 'testemail' module. Attackers can exploit the unsanitized parameter and system() function call to execute arbitrary system commands with root privileges using default credentials.

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

cxsecurity.com/issue/WLB-2019120046nvd
exchange.xforce.ibmcloud.com/vulnerabilities/172840nvd
packetstormsecurity.com/files/155616nvd
www.exploit-db.com/exploits/47765nvd
www.inim.biznvd
www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5544.phpnvd

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000