WWBN AVideo CVE-2026-89242

No special conditions are required beyond network access to the login.json.php endpoint - exploitation is unauthenticated (PR:N) and requires no user interaction (UI:N). The attacker must be able to reach the AVideo web server over the network and send a POST request to login.json.php; no account, session token, or prior knowledge of the application is needed. Exploitation is limited by: (1) the SSRF result being parsed as login credentials rather than returned verbatim, which may obscure some file content depending on parsing logic; (2) server-side egress firewall rules, if present, that block outbound connections to internal ranges; and (3) the specific PHP file-handling configuration of the server, which determines which URI schemes (file://, http://, etc.) are permitted.

The CVSS 4.0 score of 6.9 reflects a medium-severity assessment with network-accessible unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N) but limited confidentiality and integrity impact (VC:L/VI:L/VA:N), consistent with an SSRF that leaks file content rather than achieving direct code execution. The secondary impact on subsequent systems (SC:L/SI:L) acknowledges the internal-service pivot potential. No public exploit code and no CISA KEV listing indicate no confirmed active exploitation at time of analysis, and EPSS data is absent from the input. Despite the moderate score, even a mid-sized municipal IT team in walbrzych should treat this as urgent if AVideo instances are internet-facing, because unauthenticated pre-auth SSRF affecting a login endpoint can expose sensitive configuration files (e.g., database credentials in config.php) and enable internal network reconnaissance with zero barriers to entry. The credential-parsing behavior of the fetched response introduces an unconventional escalation path that the base CVSS score likely understates.

An unauthenticated attacker sends a crafted POST request to the publicly accessible login.json.php endpoint with a file path such as /var/www/html/plugin/settings/conf.php as the URL parameter. The server fetches the local file via _json_decode, parses its contents as login credentials, and the attacker observes error responses or timing differences to infer file content, potentially recovering database credentials. The attacker then pivots to submit an internal HTTP URL (e.g., targeting an internal admin API at 192.168.1.1) to probe services not otherwise reachable from the internet.