CVE-2020-22002
An Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in Inim Electronics Smartliving SmartLAN/G/SI <=6.x within the GetImage functionality.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.35%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in Inim Electronics Smartliving SmartLAN/G/SI <=6.x within the GetImage functionality. The application parses user supplied data in the GET parameter 'host' to construct an image request to the service through onvif.cgi. Since no validation is carried out on the parameter, an attacker can specify an external domain and force the application to make an HTTP request to an arbitrary destination host.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 1.35% probability · 70th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-918
- Affected
- inim/smartliving 505 firmware · inim/smartliving 515 firmware · inim/smartliving 1050 firmware · inim/smartliving 1050g3 firmware · inim/smartliving 10100l firmware · inim/smartliving 10100lg3 firmware
- Source
- cve@mitre.org
References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/172839Third Party Advisory, VDB Entry
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5545.phpExploit, Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/172839Third Party Advisory, VDB Entry
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5545.phpExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.