CVE-2020-24217

🗓️ 06 Oct 2020 13:05:36Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 108 Views🌐 WEB

An issue in HiSilicon-based IPTV/H.264/H.265 video encoders allows unauthenticated file uploads for arbitrary code execution

Reporter	Title	Published	Views	Family All 12
BDU FSTEC	The vulnerability of HiSilicon Hi3520D microprogramming chip software lies in the lack of authentication for a critical function, allowing attackers to trigger a service failure or execute arbitrary code.	15 Dec 202000:00	–	bdu_fstec
Circl	CVE-2020-24217	14 Nov 202406:07	–	circl
Check Point Advisories	Szuray Video Encoder Firmware Command Injection (CVE-2020-24217)	11 Nov 202000:00	–	checkpoint_advisories
Cvelist	CVE-2020-24217	6 Oct 202013:05	–	cvelist
Exploit DB	HiSilicon Video Encoders - RCE via unauthenticated command injection	19 Oct 202000:00	–	exploitdb
Exploit DB	HiSilicon video encoders - RCE via unauthenticated upload of malicious firmware	19 Oct 202000:00	–	exploitdb
NVD	CVE-2020-24217	6 Oct 202014:15	–	nvd
Packet Storm	HiSilicon Video Encoder Command Injection	19 Oct 202000:00	–	packetstorm
Packet Storm	HiSilicon Video Encoder Malicious Firmware Code Execution	19 Oct 202000:00	–	packetstorm
Prion	Command injection	6 Oct 202014:15	–	prion

NVD

Node

szuray iptv/h.264_video_encoder_firmwareMatch-

AND

szuray uaioe264-1uMatch-

szuray uce264-1-miniMatch-

szuray uce264-1wb-miniMatch-

szuray uce264-4-1uMatch-

szuray uce264-8-1uMatch-

szuray uhae264-16Match-

szuray uhce264-1Match-

szuray uhce264-16p32Match-

szuray uhce264-1p2Match-

szuray uhce264-1p2-1uMatch-

szuray uhce264-1sMatch-

szuray uhce264-1wMatch-

szuray uhce264-1wsMatch-

szuray uhce264-4p8Match-

szuray uhe264-1-4kMatch-

szuray uhe264-16Match-

szuray uhe264-16l-3uMatch-

szuray uhe264-16s-2uMatch-

szuray uhe264-1lMatch-

szuray uhe264-1l-4kMatch-

szuray uhe264-1lwMatch-

szuray uhe264-1sMatch-

szuray uhe264-1s-miniMatch-

szuray uhe264-1w-miniMatch-

szuray uhe264-1wb-4gMatch-

szuray uhe264-1wb-miniMatch-

szuray uhe264-1wbs-2bMatch-

szuray uhe264-1wbs-miniMatch-

szuray uhe264-1ws-miniMatch-

szuray uhe264-2-1uMatch-

szuray uhe264-4Match-

szuray uhe264-4-1uMatch-

szuray uhe264-4l-1uMatch-

szuray uhe264-8Match-

szuray uhe264-8-1uMatch-

szuray uhe264-8l-3uMatch-

szuray uhe264-8s-2uMatch-

szuray use264-16-3uMatch-

szuray use264-1lMatch-

szuray use264-1l-1uMatch-

szuray use264-1l-miniMatch-

szuray use264-1lwMatch-

szuray use264-1wb-lMatch-

szuray use264-4l-1uMatch-

szuray use264-8-1uMatch-

szuray uve264-1lMatch-

szuray uve264-1lwMatch-

Node

szuray iptv/h.265_video_encoder_firmwareMatch-

AND

szuray uaioe265-1uMatch-

szuray uhae265-1-miniMatch-

szuray uhae265-1wb-miniMatch-

szuray uhae265-4-1uMatch-

szuray uhe265-1Match-

szuray uhe265-1-1uMatch-

szuray uhe265-1-4kMatch-

szuray uhe265-1-miniMatch-

szuray uhe265-16-3uMatch-

szuray uhe265-16l-3uMatch-

szuray uhe265-1lMatch-

szuray uhe265-1lwMatch-

szuray uhe265-1s-4kMatch-

szuray uhe265-1s-miniMatch-

szuray uhe265-1wMatch-

szuray uhe265-1w-4kMatch-

szuray uhe265-1w-miniMatch-

szuray uhe265-1wb-4gMatch-

szuray uhe265-1wb-miniMatch-

szuray uhe265-1wbs-miniMatch-

szuray uhe265-2-1uMatch-

szuray uhe265-4Match-

szuray uhe265-4-1uMatch-

szuray uhe265-4sMatch-

szuray uhe265-4s-1uMatch-

szuray uhe265-8-1uMatch-

szuray uhe265-8l-3uMatch-

szuray uhe265-8s-1uMatch-

szuray uhse265-1uMatch-

szuray use265-1-1uMatch-

szuray use265-1-miniMatch-

szuray use265-16l-3uMatch-

szuray use265-1lMatch-

szuray use265-1l-1uMatch-

szuray use265-1l-miniMatch-

szuray use265-1lwMatch-

szuray use265-1w-miniMatch-

szuray use265-1wb-4gMatch-

szuray use265-1wb-lMatch-

szuray use265-1wb-miniMatch-

szuray use265-2-1uMatch-

szuray use265-4-1uMatch-

szuray use265-4l-1uMatch-

szuray use265-8-1uMatch-

szuray uve265-1Match-

szuray uve265-1wMatch-

Node

jtechdigital h.264_iptv_encoder_1080p@60hz_firmwareMatch-

AND

jtechdigital h.264_iptv_encoder_1080p@60hzMatch-

Node

provideoinstruments vecaster-hd-h264_firmwareMatch-

AND

provideoinstruments vecaster-hd-h264Match-

Node

provideoinstruments vecaster-hd-hevc_firmwareMatch-

AND

provideoinstruments vecaster-hd-hevcMatch-

Node

provideoinstruments vecaster-4k-hevc_firmwareMatch-

AND

provideoinstruments vecaster-4k-hevcMatch-

Node

provideoinstruments vecaster-hd-sdi_firmwareMatch-

AND

provideoinstruments vecaster-hd-sdiMatch-

Source	Link
kb	www.kb.cert.org/vuls/id/896979
packetstormsecurity	www.packetstormsecurity.com/files/159599/HiSilicon-Video-Encoder-Malicious-Firmware-Code-Execution.html
packetstormsecurity	www.packetstormsecurity.com/files/159597/HiSilicon-Video-Encoder-Command-Injection.html
kojenov	www.kojenov.com/2020-09-15-hisilicon-encoder-vulnerabilities/

Parameter	Position	Path	Description	CWE
upgrade	upload data	/	Unauthenticated upload endpoint vulnerable to remote code execution via malicious firmware component	CWE-306

17 Jun 2026 03:05Current

9.8High risk

Vulners AI Score9.8

CVSS 27.5

CVSS 3.19.8

EPSS0.40302

CWE-306