PT-2020-15664 · Uraytech · Uraytech Iptv/H.264/H.265 Video Encoders

Alexei Kojenov · Published 2020-10-06 · Updated 2022-01-06 · CVE-2020-24219

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions URayTech IPTV/H.264/H.265 video encoders versions through 1.97

Description An issue allows attackers to send crafted unauthenticated HTTP requests to exploit path traversal and pattern-matching programming flaws. This enables retrieval of any file from the device's file system, including the configuration file containing the cleartext administrative password.

Recommendations For versions through 1.97, update to a version that addresses the path traversal and pattern-matching programming flaws to prevent exploitation. As a temporary workaround, consider restricting access to the device's file system and limiting the use of HTTP requests until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-24219

Affected Products

Uraytech Iptv/H.264/H.265 Video Encoders

References · 7

• 🔥 http://packetstormsecurity.com/files/159595/HiSilicon-Video-Encoder-1.97-File-Disclosure-Path-Traversal.html · Exploit
• 🔥 https://exploit-db.com/exploits/48899 · Exploit
• 🔥 https://kojenov.com/2020-09-15-hisilicon-encoder-vulnerabilities · Exploit
• https://osv.dev/vulnerability/CVE-2020-24219 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24219 · Security Note
• https://kb.cert.org/vuls/id/896979 · Note
• https://t.me/cybersecuritytechnologies/1948 · Telegram Post