CVE-2025-3572 INTUMIT SmartRobot - Server-Side Request Forgery
Unauthenticated attackers can exploit SSRF in INTUMIT SmartRobot to probe internal networks and access arbitrary local files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-3572?
CVE-2025-3572 is a high-severity server-side request forgery vulnerability in INTUMIT SmartRobot, published on 14 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SmartRobot from INTUMIT has a Server-Side Request Forgery vulnerability, allowing unauthenticated remote attackers to probe internal network and even access arbitrary local files on the server.
Weakness: CWE-918
Which versions are affected by CVE-2025-3572?
It affects 1 product.
Products include Intumit Smartrobot.
How do I fix CVE-2025-3572?
No fix has been published for CVE-2025-3572 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-3572 being exploited?
There is no known exploitation of CVE-2025-3572 in the wild and no public exploit code.
Other vulnerabilities in INTUMIT SmartRobot
- CVE-2024-2413 Intumit SmartRobot - Use of Hard-coded Cryptographic Key
- CVE-2024-0552 Intumit inc. SmartRobot - Remote Code Execution
- CVE-2024-12652 Intumit SmartRobot′s Conversational AI Platform - Improper Control of Generation of Code ('Code Injection')
- CVE-2024-8776 INTUMIT SmartRobot - Cross-site Scripting
Sources
Also known as GHSA-4g3w-2657-gjq5.