NetSight
IP …
critical9.8Public exploit code

CVE-2020-24217

An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. The file-upload endpoint does not enforce authentication. Attackers can send an unauthenticated HTTP request to upload a custom firmware component, possibly in conjunction with command injection, to achieve arbitrary code execution.

Affected products

VendorProductAffected versions
SzurayIptv\/H.264 Video Encoder Firmware
All versions
SzurayIptv\/H.265 Video Encoder Firmware
All versions
JtechdigitalH.264 Iptv Encoder 1080p\@60hz Firmware
All versions
ProvideoinstrumentsVecaster-Hd-H264 Firmware
All versions
ProvideoinstrumentsVecaster-Hd-Hevc Firmware
All versions
ProvideoinstrumentsVecaster-4k-Hevc Firmware
All versions
ProvideoinstrumentsVecaster-Hd-Sdi Firmware
All versions

Weakness classification

CWE-306

References