packetstormsecurity.com
http://packetstormsecurity.com/files/159601/HiSilicon-Video-Encoder-Backdoor-Password.html CVE-2020-24215
CRITICAL
HiSilicon Video Encoders - Full admin access via backdoor password
Record summary
CVE-2020-24215 has a selected CVSS score of 9.8 (critical); EIP currently links 1 catalogued exploit.
Description
An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can use hard-coded credentials in HTTP requests to perform any administrative task on the device including retrieving the device's configuration (with the cleartext admin password), and uploading a custom firmware update, to ultimately achieve arbitrary code execution.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBHiSilicon Video Encoders - Full admin access via backdoor passwordExploitDB exploitby Alexei KojenovNot analyzed1 file
References
4kojenov.com
https://kojenov.com/2020-09-15-hisilicon-encoder-vulnerabilities nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2020-24215 kb.cert.org
https://www.kb.cert.org/vuls/id/896979