A critical remote command injection vulnerability in INIM Electronics SmartLiving SmartLAN devices allows authenticated attackers to execute arbitrary system commands with root privileges.

This is an OS Command Injection vulnerability (CWE-78) occurring in the web.cgi binary. An authenticated attacker can supply malicious input via the 'par' POST parameter during a 'testemail' module call, which is then passed to the system() function without adequate sanitization.

The CVSS score of 8.8 indicates a high severity risk, primarily due to the potential for total system compromise. Successful exploitation grants an attacker root-level access to the security control panel, which could lead to the disablement of intrusion detection features, unauthorized data access, or the use of the device as a pivot point within the local network.

Immediate Action: Contact INIM Electronics support to verify if a firmware update is available for your specific model and version, as no public patch version is explicitly documented. If no update is available, restrict access to the web interface to authorized management networks only.

Proactive Monitoring: Review web server access logs for suspicious POST requests to 'web.cgi' containing unexpected characters or shell metacharacters in the 'par' parameter. Monitor for anomalous outbound network traffic originating from the control panel, such as unexpected connections to external mail services or command-and-control servers.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block POST requests to the 'web.cgi' endpoint that contain suspicious command injection sequences in the 'par' parameter. Ensure that default administrative credentials are changed immediately to prevent unauthorized access to the management interface.

Public Exploit Available: Yes, a functional exploit script and technical details exist on ExploitDB (EDB-ID 47765) and Packet Storm Security.

Given the availability of public exploit code and the high-privilege impact of this flaw, administrators must prioritize securing these devices. If a vendor-supplied firmware update is unavailable, the most effective mitigation is to isolate the affected control panels from the public internet and restrict management access to trusted internal segments. Failure to limit access significantly increases the risk of unauthorized remote command execution.