A flaw exists in the Video File Download URL Handler of HummerRisk up to version 1.5.0, where the ServerService.addServer function accepts a manipulated streamIp argument. This manipulation enables server‑side request forgery, allowing an attacker to cause the server to initiate requests to arbitrary destinations without authentication. The vulnerability is publicly exploitable and can be launched remotely.

The affected product is HummerRisk’s Video File Download URL Handler component. All installations running version 1.5.0 or earlier are vulnerable. No specific vendors beyond HummerRisk are listed, and the vendor has yet to publish a fix.

The CVSS base score of 5.1 indicates a moderate severity. The EPSS score is not available, but the presence of a publicly available exploit and the ability to launch it remotely raise the exploitation likelihood. The vulnerability is not included in the CISA KEV catalog, suggesting limited documented exploitation at this time. The attack vector is inferred to be remote, as the description notes that the attack can be launched remotely and no local user privileges are required.