Server-Side Request Forgery in elecV2 elecV2P Products
CVE-2026-5016
Key Information:
Badges
What is CVE-2026-5016?
An identified vulnerability in the elecV2P product affects versions up to 3.8.3, specifically within the eAxios function of the URL Handler component. The vulnerability arises from improper handling of the req argument in the /mock file, leading to potential remote server-side request forgery attacks. This vulnerability allows an attacker to manipulate requests to internal services, posing serious security risks. Although the issue was brought to the vendor's attention early on, no resolution has been communicated as of now, leaving users exposed to potential exploitation.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
elecV2P 3.8.0
elecV2P 3.8.1
elecV2P 3.8.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V4
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved