CVE-2020-24215

Published: Oct 6, 2020Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can use hard-coded credentials in HTTP requests to perform any administrative task on the device including retrieving the device's configuration (with the cleartext admin password), and uploading a custom firmware update, to ultimately achieve arbitrary code execution.

Affected (7)

Products: Szuray: Iptv/h.264 Video Encoder Firmware, Iptv/h.265 Video Encoder Firmware · Jtechdigital: H.264 Iptv Encoder 1080p@60hz Firmware · Provideoinstruments: Vecaster Hd H264 Firmware, Vecaster Hd Hevc Firmware, Vecaster 4k Hevc Firmware, Vecaster Hd Sdi Firmware

Szuray

2 products

Iptv/h.264 Video Encoder Firmware

Iptv/h.265 Video Encoder Firmware

Jtechdigital

1 product

H.264 Iptv Encoder 1080p@60hz Firmware

Provideoinstruments

4 products

Vecaster Hd H264 Firmware

Vecaster Hd Hevc Firmware

Vecaster 4k Hevc Firmware

Vecaster Hd Sdi Firmware

Configuration A

1 vulnerable · 47 platform

Vulnerable Software	Affected Versions
Szuray Iptv/h.264 Video Encoder Firmware	All versions

Running on/with	Platform Versions
Szuray Uaioe264 1u	All versions
Szuray Uce264 1 Mini	All versions
Szuray Uce264 1wb Mini	All versions
Szuray Uce264 4 1u	All versions
Szuray Uce264 8 1u	All versions
Szuray Uhae264 16	All versions
Szuray Uhce264 1	All versions
Szuray Uhce264 16p32	All versions
Szuray Uhce264 1p2	All versions
Szuray Uhce264 1p2 1u	All versions
Szuray Uhce264 1s	All versions
Szuray Uhce264 1w	All versions
Szuray Uhce264 1ws	All versions
Szuray Uhce264 4p8	All versions
Szuray Uhe264 1 4k	All versions
Szuray Uhe264 16	All versions
Szuray Uhe264 16l 3u	All versions
Szuray Uhe264 16s 2u	All versions
Szuray Uhe264 1l	All versions
Szuray Uhe264 1l 4k	All versions
Szuray Uhe264 1lw	All versions
Szuray Uhe264 1s	All versions
Szuray Uhe264 1s Mini	All versions
Szuray Uhe264 1w Mini	All versions
Szuray Uhe264 1wb 4g	All versions
Szuray Uhe264 1wb Mini	All versions
Szuray Uhe264 1wbs 2b	All versions
Szuray Uhe264 1wbs Mini	All versions
Szuray Uhe264 1ws Mini	All versions
Szuray Uhe264 2 1u	All versions
Szuray Uhe264 4	All versions
Szuray Uhe264 4 1u	All versions
Szuray Uhe264 4l 1u	All versions
Szuray Uhe264 8	All versions
Szuray Uhe264 8 1u	All versions
Szuray Uhe264 8l 3u	All versions
Szuray Uhe264 8s 2u	All versions
Szuray Use264 16 3u	All versions
Szuray Use264 1l	All versions
Szuray Use264 1l 1u	All versions
Szuray Use264 1l Mini	All versions
Szuray Use264 1lw	All versions
Szuray Use264 1wb L	All versions
Szuray Use264 4l 1u	All versions
Szuray Use264 8 1u	All versions
Szuray Uve264 1l	All versions
Szuray Uve264 1lw	All versions

Configuration B

1 vulnerable · 46 platform

Vulnerable Software	Affected Versions
Szuray Iptv/h.265 Video Encoder Firmware	All versions

Running on/with	Platform Versions
Szuray Uaioe265 1u	All versions
Szuray Uhae265 1 Mini	All versions
Szuray Uhae265 1wb Mini	All versions
Szuray Uhae265 4 1u	All versions
Szuray Uhe265 1	All versions
Szuray Uhe265 1 1u	All versions
Szuray Uhe265 1 4k	All versions
Szuray Uhe265 1 Mini	All versions
Szuray Uhe265 16 3u	All versions
Szuray Uhe265 16l 3u	All versions
Szuray Uhe265 1l	All versions
Szuray Uhe265 1lw	All versions
Szuray Uhe265 1s 4k	All versions
Szuray Uhe265 1s Mini	All versions
Szuray Uhe265 1w	All versions
Szuray Uhe265 1w 4k	All versions
Szuray Uhe265 1w Mini	All versions
Szuray Uhe265 1wb 4g	All versions
Szuray Uhe265 1wb Mini	All versions
Szuray Uhe265 1wbs Mini	All versions
Szuray Uhe265 2 1u	All versions
Szuray Uhe265 4	All versions
Szuray Uhe265 4 1u	All versions
Szuray Uhe265 4s	All versions
Szuray Uhe265 4s 1u	All versions
Szuray Uhe265 8 1u	All versions
Szuray Uhe265 8l 3u	All versions
Szuray Uhe265 8s 1u	All versions
Szuray Uhse265 1u	All versions
Szuray Use265 1 1u	All versions
Szuray Use265 1 Mini	All versions
Szuray Use265 16l 3u	All versions
Szuray Use265 1l	All versions
Szuray Use265 1l 1u	All versions
Szuray Use265 1l Mini	All versions
Szuray Use265 1lw	All versions
Szuray Use265 1w Mini	All versions
Szuray Use265 1wb 4g	All versions
Szuray Use265 1wb L	All versions
Szuray Use265 1wb Mini	All versions
Szuray Use265 2 1u	All versions
Szuray Use265 4 1u	All versions
Szuray Use265 4l 1u	All versions
Szuray Use265 8 1u	All versions
Szuray Uve265 1	All versions
Szuray Uve265 1w	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Jtechdigital H.264 Iptv Encoder 1080p@60hz Firmware	All versions

Running on/with	Platform Versions
Jtechdigital H.264 Iptv Encoder 1080p@60hz	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Provideoinstruments Vecaster Hd H264 Firmware	All versions

Running on/with	Platform Versions
Provideoinstruments Vecaster Hd H264	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Provideoinstruments Vecaster Hd Hevc Firmware	All versions

Running on/with	Platform Versions
Provideoinstruments Vecaster Hd Hevc	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Provideoinstruments Vecaster 4k Hevc Firmware	All versions

Running on/with	Platform Versions
Provideoinstruments Vecaster 4k Hevc	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Provideoinstruments Vecaster Hd Sdi Firmware	All versions

Running on/with	Platform Versions
Provideoinstruments Vecaster Hd Sdi	All versions

Related CWEs

CWE-798

Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

References (6)

http://packetstormsecurity.com/files/159601/HiSilicon-Video-Encoder-Backdoor-Password.html

Source: cve@mitre.org

ExploitThird Party Advisory

https://kojenov.com/2020-09-15-hisilicon-encoder-vulnerabilities/

Source: cve@mitre.org

ExploitThird Party Advisory

https://www.kb.cert.org/vuls/id/896979

Source: cve@mitre.org

Third Party AdvisoryUS Government Resource

http://packetstormsecurity.com/files/159601/HiSilicon-Video-Encoder-Backdoor-Password.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://kojenov.com/2020-09-15-hisilicon-encoder-vulnerabilities/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://www.kb.cert.org/vuls/id/896979

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.