CVE-2020-25466

CriticalCVSS 9.8

Published: 23/10/2020(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.43%

82th percentile - higher than 82% of all known CVEs

Summary

An SSRF vulnerability in the downloadimage interface of CRMEB 3.0 allows remote attackers to download arbitrary files from the server and execute arbitrary code remotely.

Risk Assessment

Attackers can exploit this vulnerability to steal sensitive data, deploy malware, or take full control of the server, compromising confidentiality, integrity, and availability.

Recommendation

Immediately update CRMEB to the latest version and restrict access to the downloadimage interface using firewall rules and URL validation.

Original NVD description (English source)

A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on the server and remotely execute arbitrary code.