Vulnerability · Published Apr 29, 2021 · Assigned by mitre

CVE-2020-22002

High 7.5

In plain English

A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities).

Severity (CVSS NVD)7.5High

Exploit odds (30 days)1.4%top 28.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in Inim Electronics Smartliving SmartLAN/G/SI <=6.x within the GetImage functionality. The application parses user supplied data in the GET parameter 'host' to construct an image request to the service through onvif.cgi. Since no validation is carried out on the parameter, an attacker can specify an external domain and force the application to make an HTTP request to an arbitrary destination host.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5545.php x_refsource_MISC
https://exchange.xforce.ibmcloud.com/vulnerabilities/172839 x_refsource_MISC