CVE-2020-36910: Cayin Technology Smp-1000

High severity, CVSS 8.8. EPSS: 1.4% chance of exploitation in the next 30 days.

Cayin Signage Media Player 3.0 contains an authenticated remote command injection vulnerability in system.cgi and wizard_system.cgi pages. Attackers can exploit the 'NTP_Server_IP' parameter with default credentials to execute arbitrary shell commands as root.

Affected products

• Cayin Technology Smp-1000: version 1.0 Build 14099 only
• Cayin Technology Smp-200: version 1.0 Build 13080 only; version 1.0 Build 12331 only
• Cayin Technology Smp-2000: version 1.0 Build 14167 only; version 1.0 Build 14087 only
• Cayin Technology Smp-2100: version 10.0 Build 16228 only; version 3.0 only
• Cayin Technology Smp-2200: version 3.0 Build 19029 only; version 3.0 Build 19025 only
• Cayin Technology Smp-2210: version 3.0 Build 19025 only
• Cayin Technology Smp-2300: version 3.0 Build 19316 only
• Cayin Technology Smp-2310: version 3.0 only
• Cayin Technology Smp-300: version 1.0 Build 14177 only
• Cayin Technology Smp-4000: version 1.0 Build 14098 only; version 1.0 Build 14092 only; version 1.0 Build 14087 only
• Cayin Technology Smp-6000: version 3.0 Build 19025 only; version 1.0 Build 14246 only; version 1.0 Build 14199 only; version 1.0 Build 14167 only; version 1.0 Build 14097 only; version 1.0 Build 14090 only; …
• Cayin Technology Smp-8000: version 3.0 only
• Cayin Technology Smp-8000qd: version 3.0 only
• Cayin Technology Smp-Neo: version 1.0 only
• Cayin Technology Smp-NEO2: version 1.0 only
• Cayin Technology Smp-PRO4: version 1.0 only
• Cayin Technology Smp-Proplus: version 1.5 Build 10081 only
• Cayin Technology Smp-WEB4: version 2.0 Build 13073 only; version 2.0 Build 11175 only; version 1.5 Build 11476 only; version 1.5 Build 11126 only; version 1.0 Build 10301 only
• Cayin Technology Smp-Webplus: version 6.5 Build 11126 only

Published 2026-01-06. Last modified 2026-06-17.