CVE-2017-20220

🗓️ 15 Mar 2026 18:34:28Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 4 Views🌐 WEB

CVE-2017-20220: Serviio Pro 1.8 enables unauthenticated mediabrowser password change.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2017-20220	15 Mar 202618:34	–	attackerkb
CNNVD	Serviio PRO 访问控制错误漏洞	16 Mar 202600:00	–	cnnvd
Cvelist	CVE-2017-20220 Serviio PRO 1.8 Unauthenticated Password Change via REST API	15 Mar 202618:34	–	cvelist
EUVD	EUVD-2017-18934	16 Mar 202615:30	–	euvd
NVD	CVE-2017-20220	16 Mar 202614:17	–	nvd
Positive Technologies	PT-2026-25738	16 Mar 202600:00	–	ptsecurity
Vulnrichment	CVE-2017-20220 Serviio PRO 1.8 Unauthenticated Password Change via REST API	15 Mar 202618:34	–	vulnrichment
Zero Science Lab	Serviio PRO 1.8 DLNA Media Streaming Server REST API Arbitrary Password Change	3 May 201700:00	–	zeroscience

Vulners

Node

serviio serviio_proMatch1.8.0.0_pro

serviio serviio_proMatch1.7.1

serviio serviio_proMatch1.7.0

serviio serviio_proMatch1.6.1

[
  {
    "vendor": "Serviio",
    "product": "Serviio PRO",
    "versions": [
      {
        "version": "1.8.0.0 PRO",
        "status": "affected"
      },
      {
        "version": "1.7.1",
        "status": "affected"
      },
      {
        "version": "1.7.0",
        "status": "affected"
      },
      {
        "version": "1.6.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
securitylab	www.securitylab.ru/poc/486047.php
vulncheck	www.vulncheck.com/advisories/serviio-pro-unauthenticated-password-change-via-rest-api
exploit-db	www.exploit-db.com/exploits/41960/
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/125645
packetstormsecurity	www.packetstormsecurity.com/files/142386
blogs	www.blogs.securiteam.com/index.php/archives/3094
cxsecurity	www.cxsecurity.com/issue/WLB-2017050025
zeroscience	www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5407.php

Parameter	Position	Path	Description	CWE
remoteuserpassword	request body	rest/remote-access	Unauthenticated REST API allows changing the mediabrowser password via crafted PUT payload.	CWE-306
preferredremotedeliveryquality	request body	rest/remote-access	Unauthenticated REST API allows changing the mediabrowser password via crafted PUT payload.	CWE-306
portmappingenabled	request body	rest/remote-access	Unauthenticated REST API allows changing the mediabrowser password via crafted PUT payload.	CWE-306
externaladdress	request body	rest/remote-access	Unauthenticated REST API allows changing the mediabrowser password via crafted PUT payload.	CWE-306

15 Apr 2026 14:56Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

CVSS 48.7

EPSS0.00249

SSVC

CWE-306