Cayin Signage Media Player 3.0 Authenticated Remote Command Injection via NTP Parameter

Summary

Cayin Signage Media Player 3.0 contains an authenticated remote command injection vulnerability in system.cgi and wizard_system.cgi pages. Attackers can exploit the 'NTP_Server_IP' parameter with default credentials to execute arbitrary shell commands as root.

Timeline

1. Jan 6, 2026, 3:52 PM UTCCVE published
2. Jan 6, 2026, 7:31 PM UTCCISA SSVC assessment

   Exploitation: poc · Automatable: no · Technical impact: total

3. Jul 15, 2026, 1:24 AM UTCRecord last updated

Affected versions

• CAYIN Technology SMP-8000QD

  3.0

• CAYIN Technology SMP-8000

  3.0

• CAYIN Technology SMP-6000

  3.0 Build 19025, 1.0 Build 14246, 1.0 Build 14199, 1.0 Build 14167, 1.0 Build 14097, 1.0 Build 14090, 1.0 Build 14069, 1.0 Build 14062

• CAYIN Technology SMP-4000

  1.0 Build 14098, 1.0 Build 14092, 1.0 Build 14087

• CAYIN Technology SMP-2310

  3.0

• CAYIN Technology SMP-2300

  3.0 Build 19316

• CAYIN Technology SMP-2210

  3.0 Build 19025

• CAYIN Technology SMP-2200

  3.0 Build 19029, 3.0 Build 19025

• CAYIN Technology SMP-2100

  10.0 Build 16228, 3.0

• CAYIN Technology SMP-2000

  1.0 Build 14167, 1.0 Build 14087

• CAYIN Technology SMP-1000

  1.0 Build 14099

• CAYIN Technology SMP-PROPLUS

  1.5 Build 10081

• CAYIN Technology SMP-WEBPLUS

  6.5 Build 11126

• CAYIN Technology SMP-WEB4

  2.0 Build 13073, 2.0 Build 11175, 1.5 Build 11476, 1.5 Build 11126, 1.0 Build 10301

• CAYIN Technology SMP-300

  1.0 Build 14177

• CAYIN Technology SMP-200

  1.0 Build 13080, 1.0 Build 12331

• CAYIN Technology SMP-PRO4

  1.0

• CAYIN Technology SMP-NEO2

  1.0

• CAYIN Technology SMP-NEO

  1.0

References 7