CVE-2020-24214 Denial of service in n/a
Attackers can crash HiSilicon-based IPTV video encoders via crafted RTSP requests, causing repeated service interruptions until automatic reboot.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-24214?
CVE-2020-24214 is a critical denial of service vulnerability in n/a, published on 6 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can send a crafted unauthenticated RTSP request to cause a buffer overflow and application crash. The device will not be able to perform its main purpose of video encoding and streaming for up to a minute, until it automatically reboots. Attackers can send malicious requests once a minute, effectively disabling the device.
Which versions are affected by CVE-2020-24214?
It affects 7 products.
Products include Jtechdigital H.264 Iptv Encoder 1080p\@60hz Firmware, Provideoinstruments Vecaster-4k-Hevc Firmware, Provideoinstruments Vecaster-Hd-H264 Firmware, Provideoinstruments Vecaster-Hd-Hevc Firmware, Provideoinstruments Vecaster-Hd-Sdi Firmware, Szuray Iptv\/H.264 Video Encoder Firmware and 1 more.
How do I fix CVE-2020-24214?
No fix has been published for CVE-2020-24214 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-24214 being exploited?
There is no known exploitation of CVE-2020-24214 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-hx3r-63cv-95wc.