vulnwire
6.3med

CVE-2026-5259

AutohomeCorp frostmourne Alarm Preview AlarmController.java server-side request forgery

Published 7 mo ago · modified 11 d ago · JSON

CVSS
6.3
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.2%
percentile 11%
Public exploits
0
none known

A vulnerability was determined in AutohomeCorp frostmourne up to 1.0. The affected element is an unknown function of the file frostmourne-monitor/src/main/java/com/autohome/frostmourne/monitor/controller/AlarmController.java of the component Alarm Preview. Executing a manipulation can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

CISA SSVC assessment

Exploitation
Proof of concept public
Automatable
no
Technical impact
partial
Assessed
7 mo ago

Exploit prediction (EPSS)

0.21% probability of exploitation in the next 30 days, higher than 11% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA4.05.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
CNA3.16.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CNA3.06.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
CNA2.06.5AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR
CNA4.02.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA3.16.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CNA2.06.5AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected products

  • AutohomeCorp frostmourne

Classification

Weakness
  • CWE-918 Server-Side Request Forgery

References

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.