CVE-2019-25290CWE-918

INIM Electronics Smartliving SmartLAN/G/SI <=6.x Unauthenticated SSRF via GetImage

Medium · published January 7, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
30.3
In the wild
Unconfirmed
What it is

Smartliving SmartLAN/G/SI <=6.x contains an unauthenticated server-side request forgery vulnerability in the GetImage functionality through the 'host' parameter. Attackers can exploit the onvif.cgi endpoint by specifying external domains to bypass firewalls and perform network enumeration through arbitrary HTTP requests.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L
EPSS
0.00375 · 30.3th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-01-07T23:10Z
EPSS history
Timeline
  • 07 JAN 23:10Z
    INIM Electronics Smartliving SmartLAN/G/SI <=6.x Unauthenticated SSRF via GetImage
    cvelistv5