CVE-2020-22002 - CVE House
Back to Database
Status published High CVE-2020-22002

An Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in Inim...

Vulnerability Description

An Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in Inim Electronics Smartliving SmartLAN/G/SI <=6.x within the GetImage functionality. The application parses user supplied data in the GET parameter 'host' to construct an image request to the service through onvif.cgi. Since no validation is carried out on the parameter, an attacker can specify an external domain and force the application to make an HTTP request to an arbitrary destination host.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-22002

Credits & Attribution

No credits recorded in the NVD database.

References

More from inim

View All →
CVE-2020-21995
Inim Electronics Smartliving SmartLAN/G/SI <=6.x uses default hardcoded credentials. An...
Critical 9.8
CVE-2020-21992
Inim Electronics SmartLiving SmartLAN/G/SI <=6.x suffers from an authenticated remote...
High 8.8

Affected Vendor

Affected Software

smartliving 505 firmware, smartliving 515 firmware, smartliving 1050 firmware, smartliving 1050g3 firmware, smartliving 10100l firmware, smartliving 10100lg3 firmware
Vulnerable Versions:
Unknown

Timeline

Official Publish: April 29th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.