CVE-2020-22002
High
Description
An Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in Inim Electronics Smartliving SmartLAN/G/SI <=6.x within the GetImage functionality. The application parses user supplied data in the GET parameter 'host' to construct an image request to the service through onvif.cgi. Since no validation is carried out on the parameter, an attacker can specify an external domain and force the application to make an HTTP request to an arbitrary destination host.
SeverityHigh
CVSS7.5
Exploit probability—
ProductInim Smartliving 505 Firmware
PublishedApr 29, 2021
First seenApr 29, 2021
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| inim smartliving_505_firmware | No range specified | — |
| inim smartliving_515_firmware | No range specified | — |
| inim smartliving_1050_firmware | No range specified | — |
| inim smartliving_1050g3_firmware | No range specified | — |
| inim smartliving_10100l_firmware | No range specified | — |
| inim smartliving_10100lg3_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.