CVE-2020-24216 Auth bypass in n/a
Unauthenticated attackers can access private video streams on HiSilicon-based IPTV encoders by using default URLs, bypassing configured secret URL protections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-24216?
CVE-2020-24216 is a high-severity authentication bypass vulnerability in n/a, published on 6 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. When the administrator configures a secret URL for RTSP streaming, the stream is still available via its default name such as /0. Unauthenticated attackers can view video streams that are meant to be private.
Which versions are affected by CVE-2020-24216?
It affects 7 products.
Products include Jtechdigital H.264 Iptv Encoder 1080p\@60hz Firmware, Provideoinstruments Vecaster-4k-Hevc Firmware, Provideoinstruments Vecaster-Hd-H264 Firmware, Provideoinstruments Vecaster-Hd-Hevc Firmware, Provideoinstruments Vecaster-Hd-Sdi Firmware, Szuray Iptv\/H.264 Video Encoder Firmware and 1 more.
How do I fix CVE-2020-24216?
No fix has been published for CVE-2020-24216 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-24216 being exploited?
There is no known exploitation of CVE-2020-24216 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-65gx-346v-q6pf.