CVE-2019-25290
INIM Electronics Smartliving SmartLAN/G/SI <=6.x Unauthenticated SSRF via GetImage
- State
- Published
- Severity
- 6.9 Medium
- Published
- Jan 7, 2026
- Updated
- Mar 23, 2026
- Reserved
- Jan 6, 2026
Description
Smartliving SmartLAN/G/SI <=6.x contains an unauthenticated server-side request forgery vulnerability in the GetImage functionality through the 'host' parameter. Attackers can exploit the onvif.cgi endpoint by specifying external domains to bypass firewalls and perform network enumeration through arbitrary HTTP requests.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L | VulnCheck |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | VulnCheck |
Weaknesses
- CWE-918 Server-Side Request Forgery (SSRF)
Affected Products
| Product | Versions |
|---|---|
Smartliving SmartLAN/G/SIINIM Electronics s.r.l. |
|
References
- Zero Science Lab Vulnerability Advisorythird-party-advisory
- Exploit Database Entry 47764exploit
- Packet Storm Security Exploit Fileexploit
- IBM X-Force Vulnerability Exchange Entryvdb-entry
- INIM Vendor Homepageproduct
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.