Security readout for executives and security teams
Plain-English summary
Certain INIM SmartLiving SmartLAN/G/SI devices reportedly include hard-coded Linux credentials that normal administrators cannot change. If reachable, an unauthenticated attacker could log in and gain system-level access. This is business-critical for sites using these alarm/security controllers, especially where management interfaces are exposed to untrusted networks.
Executive priority
Treat as urgent for organizations using affected INIM SmartLiving devices, particularly in security, alarm, or building-control environments. Prioritize containment and vendor-guided remediation because the issue involves persistent credentials and public exploit references.
Technical view
CVE-2019-25291 is a CWE-798 hard-coded credentials issue in INIM Electronics Smartliving SmartLAN/G/SI <=6.x and listed SmartLiving models. The CVSS 4.0 score is 9.3 critical, with network attack vector, low complexity, no privileges, and high confidentiality, integrity, and availability impact. Public exploit references exist, but KEV does not list active exploitation.
Likely exposure
Exposure is most likely where affected SmartLAN/G/SI devices are reachable over the internet, shared networks, or poorly segmented building-security networks. The source bundle does not confirm default service exposure, vendor patch status, or a complete asset discovery method.
Exploitation context
Public exploit listings are cited by Exploit-DB and Packet Storm, so defenders should assume the issue is well known. The provided evidence does not establish active exploitation in the wild, and the CVE is not marked as CISA KEV.
Researcher notes
The bundle identifies hard-coded credentials in the Linux distribution image but does not provide a vendor advisory, patch version, or safe verification method. Avoid publishing credential values or login procedures. Focus validation on asset presence, versioning, network reachability, and vendor-confirmed remediation.
Mitigation direction
- Identify whether INIM Smartliving SmartLAN/G/SI <=6.x or listed models are deployed.
- Check INIM guidance or support channels for firmware updates or official remediation.
- Remove direct internet exposure for affected devices.
- Restrict management access to trusted administration networks only.
- Place devices behind firewalls or VPN-controlled access where feasible.
- Monitor affected devices for unexpected logins or configuration changes.
Validation and detection
- Inventory physical sites for SmartLiving SmartLAN/G/SI devices and model numbers.
- Confirm firmware or software version against the affected <=6.x range.
- Review network exposure from internet, guest, contractor, and corporate segments.
- Check authentication logs for unknown access where logging is available.
- Verify compensating firewall or segmentation controls are enforced.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-798: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2019-25291 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- Zero Science Lab Vulnerability AdvisoryCVE reference · third-party-advisory
- Exploit Database Entry 47763CVE reference · exploit
- Packet Storm Security Exploit FileCVE reference · exploit
- IBM X-Force Vulnerability Exchange EntryCVE reference · vdb-entry
- INIM Vendor HomepageCVE reference · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use of Hard-coded Credentials
Use of Hard-coded Credentials represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.