Lucene search

[email protected]CVE-2020-24215

HistoryOct 06, 2020 - 1:15 p.m.

CVE-2020-24215

2020-10-0613:15:13

CWE-798

[email protected]

web.nvd.nist.gov

cve-2020-24215

hisilicon

iptv

h.264

h.265

video encoders

arbitrary code execution

hard-coded credentials

firmware update

nvd

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.03 Low

EPSS

Percentile

91.0%

JSON

An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can use hard-coded credentials in HTTP requests to perform any administrative task on the device including retrieving the device’s configuration (with the cleartext admin password), and uploading a custom firmware update, to ultimately achieve arbitrary code execution.

Affected configurations

NVD

Node

szurayiptv\/h.264_video_encoder_firmwareMatch-

AND

szurayuaioe264-1uMatch-

szurayuce264-1-miniMatch-

szurayuce264-1wb-miniMatch-

szurayuce264-4-1uMatch-

szurayuce264-8-1uMatch-

szurayuhae264-16Match-

szurayuhce264-1Match-

szurayuhce264-16p32Match-

szurayuhce264-1p2Match-

szurayuhce264-1p2-1uMatch-

szurayuhce264-1sMatch-

szurayuhce264-1wMatch-

szurayuhce264-1wsMatch-

szurayuhce264-4p8Match-

szurayuhe264-1-4kMatch-

szurayuhe264-16Match-

szurayuhe264-16l-3uMatch-

szurayuhe264-16s-2uMatch-

szurayuhe264-1lMatch-

szurayuhe264-1l-4kMatch-

szurayuhe264-1lwMatch-

szurayuhe264-1sMatch-

szurayuhe264-1s-miniMatch-

szurayuhe264-1w-miniMatch-

szurayuhe264-1wb-4gMatch-

szurayuhe264-1wb-miniMatch-

szurayuhe264-1wbs-2bMatch-

szurayuhe264-1wbs-miniMatch-

szurayuhe264-1ws-miniMatch-

szurayuhe264-2-1uMatch-

szurayuhe264-4Match-

szurayuhe264-4-1uMatch-

szurayuhe264-4l-1uMatch-

szurayuhe264-8Match-

szurayuhe264-8-1uMatch-

szurayuhe264-8l-3uMatch-

szurayuhe264-8s-2uMatch-

szurayuse264-16-3uMatch-

szurayuse264-1lMatch-

szurayuse264-1l-1uMatch-

szurayuse264-1l-miniMatch-

szurayuse264-1lwMatch-

szurayuse264-1wb-lMatch-

szurayuse264-4l-1uMatch-

szurayuse264-8-1uMatch-

szurayuve264-1lMatch-

szurayuve264-1lwMatch-

Node

szurayiptv\/h.265_video_encoder_firmwareMatch-

AND

szurayuaioe265-1uMatch-

szurayuhae265-1-miniMatch-

szurayuhae265-1wb-miniMatch-

szurayuhae265-4-1uMatch-

szurayuhe265-1Match-

szurayuhe265-1-1uMatch-

szurayuhe265-1-4kMatch-

szurayuhe265-1-miniMatch-

szurayuhe265-16-3uMatch-

szurayuhe265-16l-3uMatch-

szurayuhe265-1lMatch-

szurayuhe265-1lwMatch-

szurayuhe265-1s-4kMatch-

szurayuhe265-1s-miniMatch-

szurayuhe265-1wMatch-

szurayuhe265-1w-4kMatch-

szurayuhe265-1w-miniMatch-

szurayuhe265-1wb-4gMatch-

szurayuhe265-1wb-miniMatch-

szurayuhe265-1wbs-miniMatch-

szurayuhe265-2-1uMatch-

szurayuhe265-4Match-

szurayuhe265-4-1uMatch-

szurayuhe265-4sMatch-

szurayuhe265-4s-1uMatch-

szurayuhe265-8-1uMatch-

szurayuhe265-8l-3uMatch-

szurayuhe265-8s-1uMatch-

szurayuhse265-1uMatch-

szurayuse265-1-1uMatch-

szurayuse265-1-miniMatch-

szurayuse265-16l-3uMatch-

szurayuse265-1lMatch-

szurayuse265-1l-1uMatch-

szurayuse265-1l-miniMatch-

szurayuse265-1lwMatch-

szurayuse265-1w-miniMatch-

szurayuse265-1wb-4gMatch-

szurayuse265-1wb-lMatch-

szurayuse265-1wb-miniMatch-

szurayuse265-2-1uMatch-

szurayuse265-4-1uMatch-

szurayuse265-4l-1uMatch-

szurayuse265-8-1uMatch-

szurayuve265-1Match-

szurayuve265-1wMatch-

Node

jtechdigitalh.264_iptv_encoder_1080p\@60hz_firmwareMatch-

AND

jtechdigitalh.264_iptv_encoder_1080p\@60hzMatch-

Node

provideoinstrumentsvecaster-hd-h264_firmwareMatch-

AND

provideoinstrumentsvecaster-hd-h264Match-

Node

provideoinstrumentsvecaster-hd-hevc_firmwareMatch-

AND

provideoinstrumentsvecaster-hd-hevcMatch-

Node

provideoinstrumentsvecaster-4k-hevc_firmwareMatch-

AND

provideoinstrumentsvecaster-4k-hevcMatch-

Node

provideoinstrumentsvecaster-hd-sdi_firmwareMatch-

AND

provideoinstrumentsvecaster-hd-sdiMatch-

CPENameOperatorVersion
szuray:iptv\/h.264_video_encoder_firmwareszuray iptv/h.264 video encoder firmwareeq-

CPE	Name	Operator	Version
szuray:iptv\/h.264_video_encoder_firmware	szuray iptv/h.264 video encoder firmware	eq	-

References

packetstormsecurity.com/files/159601/HiSilicon-Video-Encoder-Backdoor-Password.html

kojenov.com/2020-09-15-hisilicon-encoder-vulnerabilities/

www.kb.cert.org/vuls/id/896979

Social References

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.7 High

AI Score

Confidence

High

0.03 Low

EPSS

Percentile

91.0%

JSON

Related for CVE-2020-24215

nvd1 packetstorm1 prion1 cvelist1 exploitdb1 cert1