A function used to determine the client’s IP address in WWBN AVideo did not validate HTTP headers and therefore allowed an attacker to forge an IP address. This flaw can be exploited to bypass IP‑based access controls and conceal attacker identity from audit logs. The weakness corresponds to CWE‑348, which describes the submission of arbitrary data to an application that refuses or ignores it during validation.

The vulnerability affects the WWBN AVideo platform in all releases up to and including version 26.0. No other product versions or vendors are listed as impacted, but those using the affected code path would be susceptible until patching or upgrading past the corrected implementation.

The CVSS score of 5.3 indicates a medium severity flaw. The EPSS index is below 1 %, and the vulnerability is not present in CISA’s KEV catalog, suggesting low current exploitation activity. The attack vector is inferred to be remote, via forged HTTP headers that the application accepts without validation. An attacker merely needs to send a request with manipulated header fields such as X‑Forwarded‑For or Remote‑Addr to achieve the spoofing effect.