CVE-2026-5259

MEDIUM

AutohomeCorp frostmourne Alarm Preview AlarmController.java server-side request forgery

Title source: cna

Description

A vulnerability was determined in AutohomeCorp frostmourne up to 1.0. The affected element is an unknown function of the file frostmourne-monitor/src/main/java/com/autohome/frostmourne/monitor/controller/AlarmController.java of the component Alarm Preview. Executing a manipulation can lead to server-side request forgery. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

References (4)

Core 4

Core References

Vdb Entry vdb-entry

VDB-354449 | AutohomeCorp frostmourne Alarm Preview AlarmController.java server-side request forgery

https://vuldb.com/vuln/354449

Signature, Permissions Required signature permissions-required

VDB-354449 | CTI Indicators (IOB, IOC, IOA)

https://vuldb.com/vuln/354449/cti

Third Party Advisory third-party-advisory

Submit #780669 | AutohomeCorp frostmourne frostmourne <= 1.0 Server-Side Request Forgery

https://vuldb.com/submit/780669

Exploit exploit

https://fx4tqqfvdw4.feishu.cn/docx/GE4GdxBxKoSvBOxhkTRcsawlnhc?from=from_copylink

Scores

CVSS v3 6.3

EPSS 0.0004

EPSS Percentile 13.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-918

Status published

Products (1)

AutohomeCorp/frostmourne 1.0

Published Apr 01, 2026

Tracked Since Apr 01, 2026