CVE-2020-24217

A vulnerability exists in the box application of HiSilicon-based IPTV/H.264/H.265 video encoders , affecting products from vendors such as URayTech , J-Tech Digital , and ProVideoInstruments . The root cause is a lack of authentication on the file-upload endpoint , which allows unauthenticated at...

CVE-2020-24214

CVE-2020-24214 affects HiSilicon-based IPTV/H.264/H.265 video encoders. An unauthenticated crafted RTSP request can trigger a buffer overflow in the box application, causing a crash and a DoS state that lasts about a minute as the device reboots. Exploitation is described as unauthenticated and n...

CVE-2020-24215

CVE-2020-24215 affects HiSilicon-based IPTV/H.264/H.265 video encoders. The issue arises from hard-coded credentials in HTTP requests, enabling an attacker to perform any administrative task, retrieve device configurations (including the cleartext admin password), and upload firmware. This can le...

CVE-2020-24216

The CVE-2020-24216 issue affects HiSilicon-based IPTV/H.264/H.265 video encoders running the box application. When an administrator configures a secret RTSP streaming URL, streams remain reachable via default names (e.g., /0), allowing unauthenticated users to view streams meant to be private. Th...