Description (CNA)
Smartliving SmartLAN/G/SI <=6.x contains an unauthenticated server-side request forgery vulnerability in the GetImage functionality through the 'host' parameter. Attackers can exploit the onvif.cgi endpoint by specifying external domains to bypass firewalls and perform network enumeration through arbitrary HTTP requests.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| INIM Electronics s.r.l. / Smartliving SmartLAN/G/SI | affected <=6.0; affected 505; affected 515; affected 1050; affected 1050/G3; affected 10100L; affected 10100L/G3 |
CWE
CWE-918
References
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5545.php
- https://www.exploit-db.com/exploits/47764
- https://packetstormsecurity.com/files/155617
- https://exchange.xforce.ibmcloud.com/vulnerabilities/172839
- https://www.inim.biz/
ADP enrichment
No English description supplied.
No references supplied.