{"id":"CVE-2019-25291","state":"PUBLISHED","title":"INIM Electronics Smartliving SmartLAN/G/SI <=6.x Hard-coded Credentials Vulnerability","description":"INIM Electronics Smartliving SmartLAN/G/SI <=6.x contains hard-coded credentials in its Linux distribution image that cannot be changed through normal device operations. Attackers can exploit these persistent credentials to log in and gain unauthorized system access across multiple SmartLiving device models.","publishedAt":"2026-01-07T23:10:05.042Z","updatedAt":"2026-03-23T15:43:27.479Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["INIM Electronics s.r.l. Smartliving SmartLAN/G/SI"],"affected":[{"vendor":"INIM Electronics s.r.l.","product":"Smartliving SmartLAN/G/SI","versions":[{"version":"<=6.0","status":"affected"},{"version":"505","status":"affected"},{"version":"515","status":"affected"},{"version":"1050","status":"affected"},{"version":"1050/G3","status":"affected"},{"version":"10100L","status":"affected"},{"version":"10100L/G3","status":"affected"}]}],"references":["https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5546.php","https://www.exploit-db.com/exploits/47763","https://packetstormsecurity.com/files/155618","https://exchange.xforce.ibmcloud.com/vulnerabilities/172838","https://www.inim.biz/"],"weaknesses":["CWE-798"],"ingestedAt":"2026-10-29T19:45:53.332Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2019/25xxx/CVE-2019-25291.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2019-25291","state":"PUBLISHED","datePublished":"2026-01-07T23:10:05.042Z","dateUpdated":"2026-03-23T15:43:27.479Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-01-06T16:07:08.528Z"},"containers":{"cna":{"title":"INIM Electronics Smartliving SmartLAN/G/SI <=6.x Hard-coded Credentials Vulnerability","descriptions":[{"lang":"en","value":"INIM Electronics Smartliving SmartLAN/G/SI <=6.x contains hard-coded credentials in its Linux distribution image that cannot be changed through normal device operations. Attackers can exploit these persistent credentials to log in and gain unauthorized system access across multiple SmartLiving device models."}],"affected":[{"vendor":"INIM Electronics s.r.l.","product":"Smartliving SmartLAN/G/SI","versions":[{"version":"<=6.0","status":"affected"},{"version":"505","status":"affected"},{"version":"515","status":"affected"},{"version":"1050","status":"affected"},{"version":"1050/G3","status":"affected"},{"version":"10100L","status":"affected"},{"version":"10100L/G3","status":"affected"}]}],"references":[{"url":"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5546.php","name":"Zero Science Lab Vulnerability Advisory","tags":["third-party-advisory"]},{"url":"https://www.exploit-db.com/exploits/47763","name":"Exploit Database Entry 47763","tags":["exploit"]},{"url":"https://packetstormsecurity.com/files/155618","name":"Packet Storm Security Exploit File","tags":["exploit"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/172838","name":"IBM X-Force Vulnerability Exchange Entry","tags":["vdb-entry"]},{"url":"https://www.inim.biz/","name":"INIM Vendor Homepage","tags":["product"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.3,"baseSeverity":"CRITICAL","exploitMaturity":"NOT_DEFINED","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-798","lang":"en","description":"Use of Hard-coded Credentials","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-03-23T15:43:27.479Z"},"datePublic":"2019-12-09T00:00:00.000Z","credits":[{"lang":"en","value":"LiquidWorm as Gjoko Krstic of Zero Science Lab","type":"finder"}],"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-01-08T19:24:07.961067Z","id":"CVE-2019-25291","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-08T19:24:13.174Z"}}]}}}