PT-2026-25731 · Wowza · Streaming Engine

Published 2026-03-15 · Updated 2026-03-16 · CVE-2016-20033

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wowza Streaming Engine version 4.5.0

Description The software contains a local privilege escalation issue. Authenticated users can gain elevated privileges by replacing executable files due to incorrect file permissions that grant full access to the Everyone group. An attacker can replace the nssm x64.exe binary in the manager and engine service directories with malicious executables. When the services restart, code is executed with LocalSystem privileges.

Recommendations Apply updates to address file permission issues for the nssm x64.exe binary in the manager and engine service directories.

Exploit

Fix

LPE

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2016-20033

Affected Products

Streaming Engine

References · 5

• 🔥 https://exploit-db.com/exploits/40132 · Exploit
• 🔥 http://zeroscience.mk/en/vulnerabilities/ZSL-2016-5339.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-20033 · Security Note
• https://t.me/CVEtracker/47451 · Telegram Post
• https://vulncheck.com/advisories/wowza-streaming-engine-local-privilege-escalation-via-nssm-x64-exe · Note