CVE-2020-24215

🗓️ 06 Oct 2020 13:00:33Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 82 Views🌐 WEB

An issue in HiSilicon IPTV/H.264/H.265 video encoders allows attackers to perform arbitrary code execution

Reporter	Title	Published	Views	Family All 7
Circl	CVE-2020-24215	14 Nov 202406:07	–	circl
Cvelist	CVE-2020-24215	6 Oct 202013:00	–	cvelist
Exploit DB	HiSilicon Video Encoders - Full admin access via backdoor password	19 Oct 202000:00	–	exploitdb
NVD	CVE-2020-24215	6 Oct 202013:15	–	nvd
Packet Storm	HiSilicon Video Encoder Backdoor Password	19 Oct 202000:00	–	packetstorm
Prion	Hardcoded credentials	6 Oct 202013:15	–	prion
CERT	IPTV encoder devices contain multiple vulnerabilities	15 Sep 202000:00	–	cert

NVD

Node

szuray iptv/h.264_video_encoder_firmwareMatch-

AND

szuray uaioe264-1uMatch-

szuray uce264-1-miniMatch-

szuray uce264-1wb-miniMatch-

szuray uce264-4-1uMatch-

szuray uce264-8-1uMatch-

szuray uhae264-16Match-

szuray uhce264-1Match-

szuray uhce264-16p32Match-

szuray uhce264-1p2Match-

szuray uhce264-1p2-1uMatch-

szuray uhce264-1sMatch-

szuray uhce264-1wMatch-

szuray uhce264-1wsMatch-

szuray uhce264-4p8Match-

szuray uhe264-1-4kMatch-

szuray uhe264-16Match-

szuray uhe264-16l-3uMatch-

szuray uhe264-16s-2uMatch-

szuray uhe264-1lMatch-

szuray uhe264-1l-4kMatch-

szuray uhe264-1lwMatch-

szuray uhe264-1sMatch-

szuray uhe264-1s-miniMatch-

szuray uhe264-1w-miniMatch-

szuray uhe264-1wb-4gMatch-

szuray uhe264-1wb-miniMatch-

szuray uhe264-1wbs-2bMatch-

szuray uhe264-1wbs-miniMatch-

szuray uhe264-1ws-miniMatch-

szuray uhe264-2-1uMatch-

szuray uhe264-4Match-

szuray uhe264-4-1uMatch-

szuray uhe264-4l-1uMatch-

szuray uhe264-8Match-

szuray uhe264-8-1uMatch-

szuray uhe264-8l-3uMatch-

szuray uhe264-8s-2uMatch-

szuray use264-16-3uMatch-

szuray use264-1lMatch-

szuray use264-1l-1uMatch-

szuray use264-1l-miniMatch-

szuray use264-1lwMatch-

szuray use264-1wb-lMatch-

szuray use264-4l-1uMatch-

szuray use264-8-1uMatch-

szuray uve264-1lMatch-

szuray uve264-1lwMatch-

Node

szuray iptv/h.265_video_encoder_firmwareMatch-

AND

szuray uaioe265-1uMatch-

szuray uhae265-1-miniMatch-

szuray uhae265-1wb-miniMatch-

szuray uhae265-4-1uMatch-

szuray uhe265-1Match-

szuray uhe265-1-1uMatch-

szuray uhe265-1-4kMatch-

szuray uhe265-1-miniMatch-

szuray uhe265-16-3uMatch-

szuray uhe265-16l-3uMatch-

szuray uhe265-1lMatch-

szuray uhe265-1lwMatch-

szuray uhe265-1s-4kMatch-

szuray uhe265-1s-miniMatch-

szuray uhe265-1wMatch-

szuray uhe265-1w-4kMatch-

szuray uhe265-1w-miniMatch-

szuray uhe265-1wb-4gMatch-

szuray uhe265-1wb-miniMatch-

szuray uhe265-1wbs-miniMatch-

szuray uhe265-2-1uMatch-

szuray uhe265-4Match-

szuray uhe265-4-1uMatch-

szuray uhe265-4sMatch-

szuray uhe265-4s-1uMatch-

szuray uhe265-8-1uMatch-

szuray uhe265-8l-3uMatch-

szuray uhe265-8s-1uMatch-

szuray uhse265-1uMatch-

szuray use265-1-1uMatch-

szuray use265-1-miniMatch-

szuray use265-16l-3uMatch-

szuray use265-1lMatch-

szuray use265-1l-1uMatch-

szuray use265-1l-miniMatch-

szuray use265-1lwMatch-

szuray use265-1w-miniMatch-

szuray use265-1wb-4gMatch-

szuray use265-1wb-lMatch-

szuray use265-1wb-miniMatch-

szuray use265-2-1uMatch-

szuray use265-4-1uMatch-

szuray use265-4l-1uMatch-

szuray use265-8-1uMatch-

szuray uve265-1Match-

szuray uve265-1wMatch-

Node

jtechdigital h.264_iptv_encoder_1080p@60hz_firmwareMatch-

AND

jtechdigital h.264_iptv_encoder_1080p@60hzMatch-

Node

provideoinstruments vecaster-hd-h264_firmwareMatch-

AND

provideoinstruments vecaster-hd-h264Match-

Node

provideoinstruments vecaster-hd-hevc_firmwareMatch-

AND

provideoinstruments vecaster-hd-hevcMatch-

Node

provideoinstruments vecaster-4k-hevc_firmwareMatch-

AND

provideoinstruments vecaster-4k-hevcMatch-

Node

provideoinstruments vecaster-hd-sdi_firmwareMatch-

AND

provideoinstruments vecaster-hd-sdiMatch-

Source	Link
kb	www.kb.cert.org/vuls/id/896979
packetstormsecurity	www.packetstormsecurity.com/files/159601/HiSilicon-Video-Encoder-Backdoor-Password.html
kojenov	www.kojenov.com/2020-09-15-hisilicon-encoder-vulnerabilities/

Parameter	Position	Path	Description	CWE
Authorization	header	/get_sys	Hard-coded admin credentials allow unauthorized admin access via the /get_sys endpoint.	CWE-798

21 Nov 2024 05:14Current

9.7High risk

Vulners AI Score9.7

CVSS 25

CVSS 3.19.8

EPSS0.4218

CWE-798