Evil-DB LogoEvil-DB
← All CVEs

CVE-2020-24219

high · 7.5

An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97. Attackers can send crafted unauthenticated HTTP requests to exploit path traversal and pattern-matching programming flaws, and retrieve any file from the device's file system, including the configuration file with the cleartext administrative password.

7.5
CVSS
23.6%
EPSS (exploit prob.)
98th
EPSS percentile
2020-10-06
Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-22

Affected products

VendorProductAffected versions
szurayiptv/h.264_video_encoder_firmware<= 1.97
szurayuaioe264-1uall versions
szurayuce264-1-miniall versions
szurayuce264-1wb-miniall versions
szurayuce264-4-1uall versions
szurayuce264-8-1uall versions
szurayuhae264-16all versions
szurayuhce264-1all versions
szurayuhce264-16p32all versions
szurayuhce264-1p2all versions
szurayuhce264-1p2-1uall versions
szurayuhce264-1sall versions
szurayuhce264-1wall versions
szurayuhce264-1wsall versions
szurayuhce264-4p8all versions
szurayuhe264-1-4kall versions
szurayuhe264-16all versions
szurayuhe264-16l-3uall versions
szurayuhe264-16s-2uall versions
szurayuhe264-1lall versions
szurayuhe264-1l-4kall versions
szurayuhe264-1lwall versions
szurayuhe264-1sall versions
szurayuhe264-1s-miniall versions
szurayuhe264-1w-miniall versions
szurayuhe264-1wb-4gall versions
szurayuhe264-1wb-miniall versions
szurayuhe264-1wbs-2ball versions
szurayuhe264-1wbs-miniall versions
szurayuhe264-1ws-miniall versions
szurayuhe264-2-1uall versions
szurayuhe264-4all versions
szurayuhe264-4-1uall versions
szurayuhe264-4l-1uall versions
szurayuhe264-8all versions
szurayuhe264-8-1uall versions
szurayuhe264-8l-3uall versions
szurayuhe264-8s-2uall versions
szurayuse264-16-3uall versions
szurayuse264-1lall versions

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2020-24219