CVE-2020-7357

CVE-2020-7357 is a critical authenticated OS semi-blind command injection vulnerability affecting multiple Cayin CMS products, including CME-SE, CMS-60, CMS-40, CMS-20, and versions 8.2, 8.0, and 7.5. An attacker can exploit this by injecting arbitrary shell commands as the root user through the 'NTP_Server_IP' parameter in system.cgi, leveraging default credentials. With a CVSS score of 9.9 (CRITICAL), this vulnerability allows for complete compromise of confidentiality, integrity, and availability with low attack complexity and no user interaction required. While not listed in CISA KEV, a Metasploit module exists for exploitation, and it has garnered significant community discussion with 10 mentions, indicating active interest.