Cayin Signage Media Player 3.0 Authenticated Remote Command Injection via NTP Parameter
Priority HIGH 73CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
Cayin Signage Media Player 3.0 contains an authenticated remote command injection vulnerability in system.cgi and wizard_system.cgi pages. Attackers can exploit the 'NTP_Server_IP' parameter with default credentials to execute arbitrary shell commands as root.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01433 73rd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| CAYIN Technology | SMP-8000QD | 3.0 | — | No fix listed | CNA |
| CAYIN Technology | SMP-8000 | 3.0 | — | No fix listed | CNA |
| CAYIN Technology | SMP-6000 | 3.0 Build 19025; 1.0 Build 14246; 1.0 Build 14199; 1.0 Build 14167; 1.0 Build 14097; 1.0 Build 14090; 1.0 Build 14069; 1.0 Build 14062 | — | No fix listed | CNA |
| CAYIN Technology | SMP-4000 | 1.0 Build 14098; 1.0 Build 14092; 1.0 Build 14087 | — | No fix listed | CNA |
| CAYIN Technology | SMP-2310 | 3.0 | — | No fix listed | CNA |
| CAYIN Technology | SMP-2300 | 3.0 Build 19316 | — | No fix listed | CNA |
| CAYIN Technology | SMP-2210 | 3.0 Build 19025 | — | No fix listed | CNA |
| CAYIN Technology | SMP-2200 | 3.0 Build 19029; 3.0 Build 19025 | — | No fix listed | CNA |
| CAYIN Technology | SMP-2100 | 10.0 Build 16228; 3.0 | — | No fix listed | CNA |
| CAYIN Technology | SMP-2000 | 1.0 Build 14167; 1.0 Build 14087 | — | No fix listed | CNA |
| CAYIN Technology | SMP-1000 | 1.0 Build 14099 | — | No fix listed | CNA |
| CAYIN Technology | SMP-PROPLUS | 1.5 Build 10081 | — | No fix listed | CNA |
| CAYIN Technology | SMP-WEBPLUS | 6.5 Build 11126 | — | No fix listed | CNA |
| CAYIN Technology | SMP-WEB4 | 2.0 Build 13073; 2.0 Build 11175; 1.5 Build 11476; 1.5 Build 11126; 1.0 Build 10301 | — | No fix listed | CNA |
| CAYIN Technology | SMP-300 | 1.0 Build 14177 | — | No fix listed | CNA |
| CAYIN Technology | SMP-200 | 1.0 Build 13080; 1.0 Build 12331 | — | No fix listed | CNA |
| CAYIN Technology | SMP-PRO4 | 1.0 | — | No fix listed | CNA |
| CAYIN Technology | SMP-NEO2 | 1.0 | — | No fix listed | CNA |
| CAYIN Technology | SMP-NEO | 1.0 | — | No fix listed | CNA |
- SMP-8000QD VendorCAYIN Technology Affected 3.0 Fixed in — No fix listed CNA
- SMP-8000 VendorCAYIN Technology Affected 3.0 Fixed in — No fix listed CNA
- SMP-6000 VendorCAYIN Technology Affected 3.0 Build 19025; 1.0 Build 14246; 1.0 Build 14199; 1.0 Build 14167; 1.0 Build 14097; 1.0 Build 14090; 1.0 Build 14069; 1.0 Build 14062 Fixed in — No fix listed CNA
- SMP-4000 VendorCAYIN Technology Affected 1.0 Build 14098; 1.0 Build 14092; 1.0 Build 14087 Fixed in — No fix listed CNA
- SMP-2310 VendorCAYIN Technology Affected 3.0 Fixed in — No fix listed CNA
- SMP-2300 VendorCAYIN Technology Affected 3.0 Build 19316 Fixed in — No fix listed CNA
- SMP-2210 VendorCAYIN Technology Affected 3.0 Build 19025 Fixed in — No fix listed CNA
- SMP-2200 VendorCAYIN Technology Affected 3.0 Build 19029; 3.0 Build 19025 Fixed in — No fix listed CNA
- SMP-2100 VendorCAYIN Technology Affected 10.0 Build 16228; 3.0 Fixed in — No fix listed CNA
- SMP-2000 VendorCAYIN Technology Affected 1.0 Build 14167; 1.0 Build 14087 Fixed in — No fix listed CNA
- SMP-1000 VendorCAYIN Technology Affected 1.0 Build 14099 Fixed in — No fix listed CNA
- SMP-PROPLUS VendorCAYIN Technology Affected 1.5 Build 10081 Fixed in — No fix listed CNA
- SMP-WEBPLUS VendorCAYIN Technology Affected 6.5 Build 11126 Fixed in — No fix listed CNA
- SMP-WEB4 VendorCAYIN Technology Affected 2.0 Build 13073; 2.0 Build 11175; 1.5 Build 11476; 1.5 Build 11126; 1.0 Build 10301 Fixed in — No fix listed CNA
- SMP-300 VendorCAYIN Technology Affected 1.0 Build 14177 Fixed in — No fix listed CNA
- SMP-200 VendorCAYIN Technology Affected 1.0 Build 13080; 1.0 Build 12331 Fixed in — No fix listed CNA
- SMP-PRO4 VendorCAYIN Technology Affected 1.0 Fixed in — No fix listed CNA
- SMP-NEO2 VendorCAYIN Technology Affected 1.0 Fixed in — No fix listed CNA
- SMP-NEO VendorCAYIN Technology Affected 1.0 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-36910
- 2026-10-03 Alias added: GHSA-53xr-pv5p-mhrg
References
More CAYIN Technology vulnerabilities
- TI-2026-55464 CAYIN Technology｜CAYIN CMS-WS/CMS-SE/SMP - Arbitrary File Upload CVSS 4.0HIGH 8.6
- TI-2024-07164 CAYIN Technology CMS - Sensitive File Download CVSS 3.1HIGH 7.5
- TI-2026-55465 CAYIN Technology｜CAYIN CMS-WS/CMS-SE - Missing Authentication CVSS 4.0MEDIUM 6.9
- TI-2024-07163 CAYIN Technology CMS - OS Command Injection CVSS 3.1HIGH 7.2
Sources
- CVE-2020-36910 · CVE Program
- CVE-2020-36910 · NVD
- FIRST EPSS
- GHSA-53xr-pv5p-mhrg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences