INIM Electronics s.r.l. vulnerabilities
Published CVEs affecting INIM Electronics s.r.l. products: 3 record(s), with severity, exploitation and fixes.
CVE-2019-25291
High · 7.5
CWE-798 Jan 7, 2026
INIM Electronics Smartliving SmartLAN/G/SI <=6.x Hard-coded Credentials Vulnerability
INIM Electronics Smartliving SmartLAN/G/SI <=6.x contains hard-coded credentials in its Linux distribution image that cannot be changed through normal device operations. Attackers can exploit these persistent credentials to log in and gain unauthorized system access across multiple SmartLiving device models.
CVE-2019-25290
Medium · 5.3
CWE-918 Jan 7, 2026
INIM Electronics Smartliving SmartLAN/G/SI <=6.x Unauthenticated SSRF via GetImage
Smartliving SmartLAN/G/SI <=6.x contains an unauthenticated server-side request forgery vulnerability in the GetImage functionality through the 'host' parameter. Attackers can exploit the onvif.cgi endpoint by specifying external domains to bypass firewalls and perform network enumeration through arbitrary HTTP requests.
CVE-2019-25289
High · 8.8
CWE-78 Jan 7, 2026
INIM Electronics SmartLiving SmartLAN/G/SI <=6.x Remote Command Execution
SmartLiving SmartLAN <=6.x contains an authenticated remote command injection vulnerability in the web.cgi binary through the 'par' POST parameter with the 'testemail' module. Attackers can exploit the unsanitized parameter and system() function call to execute arbitrary system commands with root privileges using default credentials.