This vulnerability in HummerRisk up to version 1.5.0 allows an attacker to perform server-side request forgery by manipulating the streamIp parameter in the ServerService.addServer function within the Video File Download URL Handler component. Exploitation is possible remotely, and a public exploit exists. The vendor has not provided any response or patch, and no official remediation guidance is available. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to induce the vulnerable server to make arbitrary requests, potentially leading to unauthorized internal network access or information disclosure. However, the impact is rated medium with limited confidentiality, integrity, and availability effects. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should consider implementing network-level controls to restrict outbound requests from the affected service and monitor for unusual request patterns related to the streamIp parameter. Avoid exposing the vulnerable service to untrusted networks until a fix is released.