PT-2026-25738 · Undefined · Undefined

Published 2026-03-15 · Updated 2026-03-16 · CVE-2017-20220

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Serviio PRO version 1.8

Description Serviio PRO version 1.8 has an improper access control issue in the Configuration REST API. This allows unauthenticated attackers to modify the mediabrowser login password by sending crafted requests to the REST API endpoints without needing to authenticate. The vulnerable API allows modification of credentials without authorization.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2017-20220

Affected Products

Undefined

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2017-20220 · Security Note
• https://packetstormsecurity.com/files/142386 · Note
• https://zeroscience.mk/en/vulnerabilities/ZSL-2017-5407.php · Note
• https://cxsecurity.com/issue/WLB-2017050025 · Note
• https://blogs.securiteam.com/index.php/archives/3094 · Note
• https://vulncheck.com/advisories/serviio-pro-unauthenticated-password-change-via-rest-api · Note
• http://securitylab.ru/poc/486047.php · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/125645 · Note
• https://t.me/CVEtracker/47458 · Telegram Post
• https://exploit-db.com/exploits/41960 · Note