CVE-2020-24217 Missing authorization in n/a
Unauthenticated attackers can upload custom firmware components to HiSilicon-based IPTV encoders, potentially achieving arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-24217?
CVE-2020-24217 is a critical missing authorization vulnerability in n/a, published on 6 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. The file-upload endpoint does not enforce authentication. Attackers can send an unauthenticated HTTP request to upload a custom firmware component, possibly in conjunction with command injection, to achieve arbitrary code execution.
Weakness: CWE-306
Which versions are affected by CVE-2020-24217?
It affects 7 products.
Products include Jtechdigital H.264 Iptv Encoder 1080p\@60hz Firmware, Provideoinstruments Vecaster-4k-Hevc Firmware, Provideoinstruments Vecaster-Hd-H264 Firmware, Provideoinstruments Vecaster-Hd-Hevc Firmware, Provideoinstruments Vecaster-Hd-Sdi Firmware, Szuray Iptv\/H.264 Video Encoder Firmware and 1 more.
How do I fix CVE-2020-24217?
No fix has been published for CVE-2020-24217 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-24217 being exploited?
There is no known exploitation of CVE-2020-24217 in the wild and no public exploit code.
Public exploit code: 2 Exploit-DB entries.
Other vulnerabilities in n/a
Sources
Also known as GHSA-vwf4-cwv7-v664.