This vulnerability involves an SQL injection in the httpTest function of the /api/monitor-api/alarm/previewData component in AutohomeCorp frostmourne up to version 1.0. An attacker can remotely exploit this flaw by sending specially crafted requests that manipulate SQL queries, potentially leading to unauthorized data access or modification. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no user interaction required, and limited confidentiality, integrity, and availability impacts. No vendor patch or official remediation has been disclosed as of the publication date.

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the backend database remotely, potentially leading to unauthorized data disclosure or modification. The impact is rated medium severity with limited confidentiality, integrity, and availability impacts. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published, users should monitor vendor communications for updates. Until a patch is available, restricting access to the vulnerable endpoint and employing web application firewalls with SQL injection detection rules may help reduce risk.