{"id":"CVE-2019-25291","aliases":["EUVD-2026-1603","GHSA-f3p3-f3c5-vgr3"],"status":"published","title":"INIM Electronics Smartliving SmartLAN/G/SI \u003c=6.x Hard-coded Credentials Vulnerability","description":"INIM Electronics Smartliving SmartLAN/G/SI \u003c=6.x contains hard-coded credentials in its Linux distribution image that cannot be changed through normal device operations. Attackers can exploit these persistent credentials to log in and gain unauthorized system access across multiple SmartLiving device models.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00426,"percentile":0.37186,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-798"],"published":"2026-01-07T23:10:05Z","modified":"2026-06-17T02:31:59Z","products":[{"vendor":"inim electronics s.r.l.","product":"smartliving smartlan/g/si"}],"references":[{"url":"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5546.php","tags":["third-party-advisory"]},{"url":"https://www.exploit-db.com/exploits/47763","tags":["exploit"]},{"url":"https://packetstormsecurity.com/files/155618","tags":["exploit"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/172838","tags":["vdb-entry"]},{"url":"https://www.inim.biz/","tags":["product"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25291"},{"url":"https://www.inim.biz"},{"url":"https://github.com/advisories/GHSA-f3p3-f3c5-vgr3"}],"sources":{"cve":[{"id":"CVE-2019-25291","title":"INIM Electronics Smartliving SmartLAN/G/SI \u003c=6.x Hard-coded Credentials Vulnerability","description":"INIM Electronics Smartliving SmartLAN/G/SI \u003c=6.x contains hard-coded credentials in its Linux distribution image that cannot be changed through normal device operations. Attackers can exploit these persistent credentials to log in and gain unauthorized system access across multiple SmartLiving device models.","status":"published","published":"2026-01-07T23:10:05.042Z","modified":"2026-03-23T15:43:27.479Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:20:19.737165Z"}],"euvd":[{"id":"EUVD-2026-1603","description":"INIM Electronics Smartliving SmartLAN/G/SI \u003c=6.x contains hard-coded credentials in its Linux distribution image that cannot be changed through normal device operations. Attackers can exploit these persistent credentials to log in and gain unauthorized system access across multiple SmartLiving device models.","status":"published","published":"2026-01-07T23:10:05Z","modified":"2026-03-23T15:43:27Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T19:25:31.168902Z"}],"ghsa":[{"id":"GHSA-f3p3-f3c5-vgr3","title":"INIM Electronics Smartliving SmartLAN/G/SI \u003c=6.x contains hard-coded credentials in its Linux...","description":"INIM Electronics Smartliving SmartLAN/G/SI \u003c=6.x contains hard-coded credentials in its Linux distribution image that cannot be changed through normal device operations. Attackers can exploit these persistent credentials to log in and gain unauthorized system access across multiple SmartLiving device models.","status":"published","published":"2026-01-08T00:31:15Z","modified":"2026-01-08T00:31:21Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T15:05:32.392087Z"}],"nvd":[{"id":"CVE-2019-25291","description":"INIM Electronics Smartliving SmartLAN/G/SI \u003c=6.x contains hard-coded credentials in its Linux distribution image that cannot be changed through normal device operations. Attackers can exploit these persistent credentials to log in and gain unauthorized system access across multiple SmartLiving device models.","status":"published","published":"2026-01-08T00:15:59.143Z","modified":"2026-06-17T02:31:59.43Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:05:49.934131Z"}]}}