CAYIN Technology vulnerabilities and threats

CAYIN CMS-WS and CMS-SE products from CAYIN Technology have a missing authentication vulnerability that allows unauthenticated remote attackers to access media file lists. This results in partial information disclosure without requiring user interaction or privileges. The vulnerability is identified as CWE-306 and has a medium severity score of 5.3. No patch or official remediation has been confirmed yet.

CAYIN Technology's CMS-WS, CMS-SE, and SMP series products contain an arbitrary file upload vulnerability (CWE-434) that allows privileged remote attackers to upload and execute web shells, leading to arbitrary code execution on the server. This vulnerability has a high severity with a CVSS score of 7.2. No specific affected versions or patches are currently documented, and no known exploits are reported in the wild.