This vulnerability in sergomanov SmartHomeAdatum up to commit cf495353d81b680675eb8d9aa14a318aa45ce12c allows remote attackers to perform SQL injection via manipulation of the Login argument in an unknown function of users.php in the Login component. The product's rolling release model means no discrete version numbers are provided for affected or fixed releases. The vendor has not issued any advisory or patch, and the remediation level is unknown. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database remotely without authentication or user interaction. This could lead to unauthorized data access or modification. However, the impact is rated as medium due to low confidentiality, integrity, and availability impacts as per the CVSS vector. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is available, users should monitor for vendor updates. Until a fix is released, consider restricting access to the affected component or implementing web application firewall rules to detect and block SQL injection attempts targeting the Login parameter.