This vulnerability involves SQL injection in the Login component of sergomanov SmartHomeAdatum, specifically in an unknown function within users.php. The injection is possible through manipulation of the Login argument, enabling remote exploitation. Due to the rolling release nature of the product, no explicit versioning information is provided for affected or fixed releases. The vendor was contacted but did not provide any response or patch information. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low privileges required, and no user interaction needed.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the backend database via the Login parameter. This could lead to unauthorized data access or modification. However, the CVSS vector indicates low confidentiality, integrity, and availability impact, suggesting limited but non-negligible consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should monitor official channels for updates. Until a fix is released, consider restricting access to the Login component or applying web application firewall (WAF) rules to detect and block SQL injection attempts targeting this parameter.