CVE-2025-3572

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

SmartRobot from INTUMIT has a Server-Side Request Forgery vulnerability, allowing unauthenticated remote attackers to probe internal network and even access arbitrary local files on the server.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
INTUMIT	SmartRobot	< 8.0.0

References

https://www.twcert.org.tw/en/cp-139-10065-2494c-2.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-10064-6346a-1.htmlThird Party Advisory

Timeline

Published: Apr 14, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-35736.1Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting (XSS) in the showLabel() function, which may CVE-2025-35748.7Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others u CVE-2025-35758.7Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others u CVE-2025-35765.9A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in th CVE-2025-35774.9**UNSUPPORTED WHEN ASSIGNED** A path traversal vulnerability in the web management interface of the Zyxel AMG1302-T10B firmware version 2.00 CVE-2025-35789.3A malicious, authenticated user in Aidex, versions prior to 1.7, could list credentials of other users, create or modify existing users in t CVE-2025-35799.3In versions prior to Aidex 1.7, an authenticated malicious user, taking advantage of an open registry, could execute unauthorised commands w CVE-2025-35805.5An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server admini CVE-2025-35814.8The Newsletter WordPress plugin before 8.8.5 does not validate and escape some of its Widget options before outputting them back in a page/CVE-2025-35824.8The Newsletter WordPress plugin before 8.85 does not sanitise and escape some of its Form settings, which could allow high privilege users CVE-2025-35834.8The Newsletter WordPress plugin before 8.7.1 does not sanitise and escape some of its settings, which could allow high privilege users such CVE-2025-35844.8The Newsletter WordPress plugin before 8.8.2 does not sanitise and escape some of its Subscription settings, which could allow high privile