cve/2020/CVE-2020-24214.md

CVE-2020-24214

Description

An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can send a crafted unauthenticated RTSP request to cause a buffer overflow and application crash. The device will not be able to perform its main purpose of video encoding and streaming for up to a minute, until it automatically reboots. Attackers can send malicious requests once a minute, effectively disabling the device.

POC

Reference

• http://packetstormsecurity.com/files/159605/HiSilicon-Video-Encoder-Buffer-Overflow-Denial-Of-Service.html
• http://packetstormsecurity.com/files/159605/HiSilicon-Video-Encoder-Buffer-Overflow-Denial-Of-Service.html

Github

• https://github.com/Ares-X/VulWiki
• https://github.com/SouthWind0/southwind0.github.io
• https://github.com/kojenov/hisilicon-iptv-exploits