This vulnerability in HummerRisk up to version 1.5.0 involves the ServerService.addServer function within ServerService.java, specifically in the Video File Download URL Handler component. By manipulating the streamIp parameter, an attacker can perform server-side request forgery (SSRF), causing the server to send crafted requests to arbitrary destinations. The issue can be exploited remotely without user interaction and requires high privileges. The vendor has not issued any fix or advisory, and no patch links are available. The CVSS 4.0 vector indicates network attack vector, low complexity, no user interaction, and limited impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with high privileges to induce the vulnerable server to make arbitrary HTTP requests, potentially accessing internal resources or services not otherwise reachable. The impact on confidentiality, integrity, and availability is limited but can facilitate further attacks or information gathering. There are no known exploits in the wild at this time.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to disclosure attempts. Organizations should monitor for any future vendor advisories or patches. Until a fix is released, restricting access to the vulnerable function or limiting network access to trusted sources may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.