Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-25290: Smartliving SmartLAN/G/SI <=6.x: Malicious Requests Can Access Unauthorized Networks

CVE-2019-25290 · published 10 months ago

Summary

An attacker without permission can access and scan networks that your company's network is not supposed to access. This can happen if your company uses an outdated version of the Smartliving SmartLAN/G/SI software. Update to a newer version to prevent this risk.

Original advisory text

Smartliving SmartLAN/G/SI <=6.x contains an unauthenticated server-side request forgery vulnerability in the GetImage functionality through the 'host' parameter. Attackers can exploit the onvif.cgi endpoint by specifying external domains to bypass firewalls and perform network enumeration through arbitrary HTTP requests.

References

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

6.9 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-918Server-Side Request Forgery (SSRF)

Timeline

Published8 Jan 2026

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2019-25290 · NVD

Track software like this

Free during beta