PT-2020-5055 · Hisilicon · Hisilicon Hi3520D
Alexei Kojenov
·
Published
2020-10-06
·
Updated
2022-01-01
·
CVE-2020-24217
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
HiSilicon Hi3520D (affected versions not specified)
Description
The issue is related to the lack of authentication for a critical function in the HiSilicon Hi3520D chip set's firmware. This can be exploited by a remote attacker to cause a denial of service or execute arbitrary code. Specifically, the file-upload endpoint in the box application on HiSilicon based IPTV/H.264/H.265 video encoders does not enforce authentication, allowing attackers to send an unauthenticated HTTP request to upload a custom firmware component, which can lead to arbitrary code execution.
Recommendations
As a temporary workaround, consider disabling the file-upload functionality until a patch is available.
Restrict access to the box application on HiSilicon based IPTV/H.264/H.265 video encoders to minimize the risk of exploitation.
Avoid using the file-upload endpoint in the affected application until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Missing Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Hisilicon Hi3520D