CVE-2019-25290

6.9 mediumEPSS 0.4%

Smartliving SmartLAN/G/SI <=6.x contains an unauthenticated server-side request forgery vulnerability in the GetImage functionality through the 'host' parameter. Attackers can exploit the onvif.cgi endpoint by specifying external domains to bypass firewalls and perform network enumeration through arbitrary HTTP requests.

Severity

CVSS 4.0

6.9 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 31% of CVEs (scores of 2026-10-31)
CWE: CWE-918
Published: 2026-01-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/172839
https://packetstormsecurity.com/files/155617
https://www.exploit-db.com/exploits/47764
https://www.inim.biz/
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5545.php

Check your stack JSON