Srs
Monthly
Missing authentication in the OSSRS SRS proxy System API (internal/proxy/api.go, function systemAPI.Run) lets remote unauthenticated attackers reach management/registration endpoints of the proxy component without presenting any credentials. The affected component is the newer SRS proxy mode in versions up to 7.0-a1; deployments that do not run the proxy component, or that keep its System API port off the network, are not exposed. Exploitation is practical - publicly available exploit code exists (CVSS 4.0 E:P) and the referenced issue #4690 documents the exposure - but this is a moderate-priority finding, not an inflated critical one, with limited per-CVSS confidentiality, integrity and availability impact (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, base 6.9 under CVSS 4.0). No CISA KEV entry or confirmed active exploitation is associated with this CVE at time of analysis.
Missing authentication in the OSSRS SRS proxy System API (internal/proxy/api.go, function systemAPI.Run) lets remote unauthenticated attackers reach management/registration endpoints of the proxy component without presenting any credentials. The affected component is the newer SRS proxy mode in versions up to 7.0-a1; deployments that do not run the proxy component, or that keep its System API port off the network, are not exposed. Exploitation is practical - publicly available exploit code exists (CVSS 4.0 E:P) and the referenced issue #4690 documents the exposure - but this is a moderate-priority finding, not an inflated critical one, with limited per-CVSS confidentiality, integrity and availability impact (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, base 6.9 under CVSS 4.0). No CISA KEV entry or confirmed active exploitation is associated with this CVE at time of analysis.