What’s Vulnerable › Vulnerabilities

CVE-2020-17386: Cellopoint CelloOS - Server-Side Request Forgery (SSRF)

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-08-25 · updated 2026-06-17
• Weakness: CWE-918

Description

Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly. With cookie of an authenticated user, attackers can temper with the URL parameter and access arbitrary file on system.

Affected products

• Cellopoint Cellos: 4.1.10-build20190922

References

• https://www.twcert.org.tw/tw/cp-132-3847-c62ca-1.html
• https://www.twcert.org.tw/tw/cp-132-3847-c62ca-1.html

Get alerted when CVE-2020-17386 or the next vulnerability affects your stack