Evil-DB LogoEvil-DB
← All CVEs

CVE-2020-24217

critical · 9.8

An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. The file-upload endpoint does not enforce authentication. Attackers can send an unauthenticated HTTP request to upload a custom firmware component, possibly in conjunction with command injection, to achieve arbitrary code execution.

9.8
CVSS
40.3%
EPSS (exploit prob.)
99th
EPSS percentile
2020-10-06
Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-306

Affected products

VendorProductAffected versions
szurayiptv/h.264_video_encoder_firmwareall versions
szurayuaioe264-1uall versions
szurayuce264-1-miniall versions
szurayuce264-1wb-miniall versions
szurayuce264-4-1uall versions
szurayuce264-8-1uall versions
szurayuhae264-16all versions
szurayuhce264-1all versions
szurayuhce264-16p32all versions
szurayuhce264-1p2all versions
szurayuhce264-1p2-1uall versions
szurayuhce264-1sall versions
szurayuhce264-1wall versions
szurayuhce264-1wsall versions
szurayuhce264-4p8all versions
szurayuhe264-1-4kall versions
szurayuhe264-16all versions
szurayuhe264-16l-3uall versions
szurayuhe264-16s-2uall versions
szurayuhe264-1lall versions
szurayuhe264-1l-4kall versions
szurayuhe264-1lwall versions
szurayuhe264-1sall versions
szurayuhe264-1s-miniall versions
szurayuhe264-1w-miniall versions
szurayuhe264-1wb-4gall versions
szurayuhe264-1wb-miniall versions
szurayuhe264-1wbs-2ball versions
szurayuhe264-1wbs-miniall versions
szurayuhe264-1ws-miniall versions
szurayuhe264-2-1uall versions
szurayuhe264-4all versions
szurayuhe264-4-1uall versions
szurayuhe264-4l-1uall versions
szurayuhe264-8all versions
szurayuhe264-8-1uall versions
szurayuhe264-8l-3uall versions
szurayuhe264-8s-2uall versions
szurayuse264-16-3uall versions
szurayuse264-1lall versions

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2020-24217