CVE-2021-47708
CriticalSummary
COMMAX Smart Home System CDP-1020n contains an SQL injection vulnerability that allows attackers to bypass authentication by injecting arbitrary SQL code through the 'id' parameter in 'loginstart.asp'. Attackers can exploit this by sending a POST request with malicious 'id' values to manipulate database queries and gain unauthorized access.
Risk Assessment
The risk for the organization is unauthorized access to the smart home system, which can lead to privacy breaches and physical security issues.
Recommendation
It is recommended to immediately update the device firmware and restrict access to the login panel to trusted networks only.
Original NVD description (English source)
COMMAX Smart Home System CDP-1020n contains an SQL injection vulnerability that allows attackers to bypass authentication by injecting arbitrary SQL code through the 'id' parameter in 'loginstart.asp'. Attackers can exploit this by sending a POST request with malicious 'id' values to manipulate database queries and gain unauthorized access.