Back to CVE Browser

CVE-2020-24215

CRITICAL

9.8

CVSS Severity Score

EPSS Score0.1930%

EPSS Percentile40.51th

PublishedOct 6, 2020

Last ModifiedNov 21, 2024

Vulnerability Description

An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can use hard-coded credentials in HTTP requests to perform any administrative task on the device including retrieving the device's configuration (with the cleartext admin password), and uploading a custom firmware update, to ultimately achieve arbitrary code execution.

Affected Platforms (CPE)

💻

Szuray

Iptv\/h.264 Video Encoder Firmware

All versions

💻

Szuray

Iptv\/h.265 Video Encoder Firmware

All versions

💻

Jtechdigital

H.264 Iptv Encoder 1080p\@60hz Firmware

All versions

💻

Provideoinstruments

Vecaster Hd H264 Firmware

All versions

💻

Provideoinstruments

Vecaster Hd Hevc Firmware

All versions

💻

Provideoinstruments

Vecaster 4k Hevc Firmware

All versions

💻

Provideoinstruments

Vecaster Hd Sdi Firmware

All versions

References & Advisories

🔗 http://packetstormsecurity.com/files/159601/HiSilicon-Video-Encoder-Backdoor-Password.html

🔗 https://kojenov.com/2020-09-15-hisilicon-encoder-vulnerabilities/

🔗 https://www.kb.cert.org/vuls/id/896979

🔗 http://packetstormsecurity.com/files/159601/HiSilicon-Video-Encoder-Backdoor-Password.html

🔗 https://kojenov.com/2020-09-15-hisilicon-encoder-vulnerabilities/

🔗 https://www.kb.cert.org/vuls/id/896979

Related Vulnerabilities

CVE-2020-195310.0

Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes i...

CVE-2020-1238810.0

The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this iss...

CVE-2020-079610.0

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles cer...

CVE-2020-1238910.0

The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape. *Note: this iss...

CVE-2020-24215 Detail & Impact Analysis | CVSS 9.8 (CRITICAL) | Cyber-Sec.Space | Cyber-Sec.Space