Lucene search

[email protected]NVD:CVE-2020-24214

HistoryOct 06, 2020 - 1:15 p.m.

CVE-2020-24214

2020-10-0613:15:13

[email protected]

web.nvd.nist.gov

buffer overflow

hisilicon

iptv

video encoders

application crash

device downtime

rtsp request

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.022

Percentile

89.5%

JSON

An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can send a crafted unauthenticated RTSP request to cause a buffer overflow and application crash. The device will not be able to perform its main purpose of video encoding and streaming for up to a minute, until it automatically reboots. Attackers can send malicious requests once a minute, effectively disabling the device.

Affected configurations

Nvd

Node

szurayuaioe264-1uMatch-

szurayuce264-1-miniMatch-

szurayuce264-1wb-miniMatch-

szurayuce264-4-1uMatch-

szurayuce264-8-1uMatch-

szurayuhae264-16Match-

szurayuhce264-1Match-

szurayuhce264-16p32Match-

szurayuhce264-1p2Match-

szurayuhce264-1p2-1uMatch-

szurayuhce264-1sMatch-

szurayuhce264-1wMatch-

szurayuhce264-1wsMatch-

szurayuhce264-4p8Match-

szurayuhe264-1-4kMatch-

szurayuhe264-16Match-

szurayuhe264-16l-3uMatch-

szurayuhe264-16s-2uMatch-

szurayuhe264-1lMatch-

szurayuhe264-1l-4kMatch-

szurayuhe264-1lwMatch-

szurayuhe264-1sMatch-

szurayuhe264-1s-miniMatch-

szurayuhe264-1w-miniMatch-

szurayuhe264-1wb-4gMatch-

szurayuhe264-1wb-miniMatch-

szurayuhe264-1wbs-2bMatch-

szurayuhe264-1wbs-miniMatch-

szurayuhe264-1ws-miniMatch-

szurayuhe264-2-1uMatch-

szurayuhe264-4Match-

szurayuhe264-4-1uMatch-

szurayuhe264-4l-1uMatch-

szurayuhe264-8Match-

szurayuhe264-8-1uMatch-

szurayuhe264-8l-3uMatch-

szurayuhe264-8s-2uMatch-

szurayuse264-16-3uMatch-

szurayuse264-1lMatch-

szurayuse264-1l-1uMatch-

szurayuse264-1l-miniMatch-

szurayuse264-1lwMatch-

szurayuse264-1wb-lMatch-

szurayuse264-4l-1uMatch-

szurayuse264-8-1uMatch-

szurayuve264-1lMatch-

szurayuve264-1lwMatch-

AND

szurayiptv\/h.264_video_encoder_firmwareMatch-

Node

szurayuaioe265-1uMatch-

szurayuhae265-1-miniMatch-

szurayuhae265-1wb-miniMatch-

szurayuhae265-4-1uMatch-

szurayuhe265-1Match-

szurayuhe265-1-1uMatch-

szurayuhe265-1-4kMatch-

szurayuhe265-1-miniMatch-

szurayuhe265-16-3uMatch-

szurayuhe265-16l-3uMatch-

szurayuhe265-1lMatch-

szurayuhe265-1lwMatch-

szurayuhe265-1s-4kMatch-

szurayuhe265-1s-miniMatch-

szurayuhe265-1wMatch-

szurayuhe265-1w-4kMatch-

szurayuhe265-1w-miniMatch-

szurayuhe265-1wb-4gMatch-

szurayuhe265-1wb-miniMatch-

szurayuhe265-1wbs-miniMatch-

szurayuhe265-2-1uMatch-

szurayuhe265-4Match-

szurayuhe265-4-1uMatch-

szurayuhe265-4sMatch-

szurayuhe265-4s-1uMatch-

szurayuhe265-8-1uMatch-

szurayuhe265-8l-3uMatch-

szurayuhe265-8s-1uMatch-

szurayuhse265-1uMatch-

szurayuse265-1-1uMatch-

szurayuse265-1-miniMatch-

szurayuse265-16l-3uMatch-

szurayuse265-1lMatch-

szurayuse265-1l-1uMatch-

szurayuse265-1l-miniMatch-

szurayuse265-1lwMatch-

szurayuse265-1w-miniMatch-

szurayuse265-1wb-4gMatch-

szurayuse265-1wb-lMatch-

szurayuse265-1wb-miniMatch-

szurayuse265-2-1uMatch-

szurayuse265-4-1uMatch-

szurayuse265-4l-1uMatch-

szurayuse265-8-1uMatch-

szurayuve265-1Match-

szurayuve265-1wMatch-

AND

szurayiptv\/h.265_video_encoder_firmwareMatch-

Node

jtechdigitalh.264_iptv_encoder_1080p\@60hzMatch-

AND

jtechdigitalh.264_iptv_encoder_1080p\@60hz_firmwareMatch-

Node

provideoinstrumentsvecaster-hd-h264Match-

AND

provideoinstrumentsvecaster-hd-h264_firmwareMatch-

Node

provideoinstrumentsvecaster-hd-hevcMatch-

AND

provideoinstrumentsvecaster-hd-hevc_firmwareMatch-

Node

provideoinstrumentsvecaster-4k-hevcMatch-

AND

provideoinstrumentsvecaster-4k-hevc_firmwareMatch-

Node

provideoinstrumentsvecaster-hd-sdiMatch-

AND

provideoinstrumentsvecaster-hd-sdi_firmwareMatch-

References

packetstormsecurity.com/files/159605/HiSilicon-Video-Encoder-Buffer-Overflow-Denial-Of-Service.html

kojenov.com/2020-09-15-hisilicon-encoder-vulnerabilities/

www.kb.cert.org/vuls/id/896979

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.022

Percentile

89.5%

JSON

Related for NVD:CVE-2020-24214

cve1 exploitdb1 packetstorm1 cvelist1 zdt1 prion1 cert1