This vulnerability in zevorn rt-claw (versions 0.1 and 0.2.0) affects the claw_net_get and claw_net_post functions in claw/tools/tool_net.c. By manipulating the URL argument passed to these functions, an attacker can perform server-side request forgery (SSRF), potentially causing the server to make unintended HTTP requests. The vulnerability is remotely exploitable and an exploit is publicly available. The vendor has not yet issued a response or patch.

An attacker can exploit this vulnerability remotely to induce the server to make arbitrary HTTP requests, which may lead to information disclosure or interaction with internal systems not otherwise accessible. The CVSS 4.0 score of 6.9 reflects a medium severity with network attack vector, no privileges or user interaction required, and low impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider implementing network-level restrictions to limit outbound requests from the affected component or isolate the vulnerable service until a patch is available.