{"cve":"CVE-2020-22002","nvd":{"published":"2021-04-29T15:15:10.537","modified":"2026-06-17T03:04:02.590","status":"Modified","description":"An Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in Inim Electronics Smartliving SmartLAN/G/SI <=6.x within the GetImage functionality. The application parses user supplied data in the GET parameter 'host' to construct an image request to the service through onvif.cgi. Since no validation is carried out on the parameter, an attacker can specify an external domain and force the application to make an HTTP request to an arbitrary destination host.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5},"cwes":["CWE-918"],"references":["https://exchange.xforce.ibmcloud.com/vulnerabilities/172839","https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5545.php","https://exchange.xforce.ibmcloud.com/vulnerabilities/172839","https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5545.php"],"products":["inim:smartliving_10100l_firmware","inim:smartliving_10100lg3_firmware","inim:smartliving_1050_firmware","inim:smartliving_1050g3_firmware","inim:smartliving_505_firmware","inim:smartliving_515_firmware"],"source":"nvd","synced_at":"2026-10-19T21:18:09.669877188+00:00"},"epss":{"cve":"CVE-2020-22002","score":0.01352,"percentile":0.71559,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}