What’s Vulnerable › Vulnerabilities

CVE-2020-7357: Cayin CMS Command Injection

• Severity: critical (CVSS 9.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 32.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-08-06 · updated 2026-06-17
• Weakness: CWE-78

Description

Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user through the 'NTP_Server_IP' HTTP POST parameter in system.cgi page. This issue affects several branches and versions of the CMS application, including CME-SE, CMS-60, CMS-40, CMS-20, and CMS version 8.2, 8.0, and 7.5.

Affected products

• Cayintech Cms: 7.5-11175, 8.0-11175, 8.2-12199
• Cayintech Cms-20 Firmware: 9.0-14197, 9.0-14092
• Cayintech Cms-40 Firmware: 9.0-14197, 9.0-14199, 9.0-14093
• Cayintech Cms-60 Firmware: 11.0-19025
• Cayintech Cms-Se-Lxc Firmware: all versions
• Cayintech Cms-Se Firmware: 11.0-19179, 11.0-19025, 11.0-18325

References

• https://exchange.xforce.ibmcloud.com/vulnerabilities/182925
• https://github.com/rapid7/metasploit-framework/pull/13607
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5570.php
• https://exchange.xforce.ibmcloud.com/vulnerabilities/182925
• https://github.com/rapid7/metasploit-framework/pull/13607
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5570.php

Get alerted when CVE-2020-7357 or the next vulnerability affects your stack