crmeb_java CVE-2026-10771

No special conditions required for initial access - the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N confirms the endpoint is remotely reachable with no authentication (PR:N), no user interaction (UI:N), and low attack complexity. The specific exploitable condition is that the base64 Qrcode endpoint must be network-accessible to the attacker; if the endpoint is firewalled or placed behind an authentication gateway, exploitation is blocked. The practical impact of successful exploitation is bounded by what internal services the application server can reach: environments with unrestricted egress and cloud metadata services (especially IMDSv1) face materially higher impact than isolated deployments. No exploitation of a non-default configuration is required.

The CVSS 4.0 base score of 5.5 (Medium) reflects AV:N/AC:L/AT:N/PR:N/UI:N with low confidentiality, integrity, and availability impacts and no scope change (SC:N/SI:N/SA:N). The E:P modifier confirms a public proof-of-concept exists, raising the exploitability signal. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, indicating no confirmed widespread active exploitation at time of analysis. The raw CVSS score of 5.5 underrepresents real-world risk in cloud-hosted deployments: SSRF against AWS, GCP, or Azure instances can reach the IMDS endpoint to retrieve instance credentials (particularly if IMDSv1 is in use), elevating the effective impact well beyond the 'low' confidentiality rating captured by the vector. Conversely, in air-gapped or strictly network-segmented environments, impact is genuinely limited. The absence of vendor response amplifies residual risk, as no timeline for remediation exists.

A public exploit exists, published as GitHub issue #35 against the crmeb_java repository. An unauthenticated attacker sends an HTTP request to the base64 Qrcode endpoint with the url parameter set to an internal target such as http://169.254.169.254/latest/meta-data/ (cloud IMDS) or an internal administrative API; the server's RestTemplate.getForEntity call fetches the resource and the response may be reflected back to the attacker or trigger observable side effects, revealing internal topology or credentials.