PT-2026-25731 · Wowza · Streaming Engine

CVE-2016-20033 · Publicado 2026-03-15 · Atualizado 2026-03-16

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wowza Streaming Engine version 4.5.0

Description The software contains a local privilege escalation issue. Authenticated users can gain elevated privileges by replacing executable files due to incorrect file permissions that grant full access to the Everyone group. An attacker can replace the nssm x64.exe binary in the manager and engine service directories with malicious executables. When the services restart, code is executed with LocalSystem privileges.

Recommendations Apply updates to address file permission issues for the nssm x64.exe binary in the manager and engine service directories.

Exploit

Correção

LPE

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2016-20033

Produtos afetados

Streaming Engine

Referências · 5

• 🔥 https://exploit-db.com/exploits/40132 · Exploit
• 🔥 http://zeroscience.mk/en/vulnerabilities/ZSL-2016-5339.php · Exploit
• https://t.me/CVEtracker/47451 · Publicação no Telegram
• https://vulncheck.com/advisories/wowza-streaming-engine-local-privilege-escalation-via-nssm-x64-exe · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-20033 · Nota de Segurança