Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2019-25290

INIM Electronics Smartliving SmartLAN/G/SI <=6.x Unauthenticated SSRF via GetImage

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Smartliving SmartLAN/G/SI <=6.x contains an unauthenticated server-side request forgery vulnerability in the GetImage functionality through the 'host' parameter. Attackers can exploit the onvif.cgi endpoint by specifying external domains to bypass firewalls and perform network enumeration through arbitrary HTTP requests.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

INIM Electronics s.r.l. Smartliving SmartLAN/G/SI

  • <=6.0affected
  • 505affected
  • 515affected
  • 1050affected
  • 1050/G3affected
  • 10100Laffected
  • 10100L/G3affected

References