CVE-2020-24214

CVE-2020-24214 is a critical-severity vulnerability in Szuray Iptv/h.264 Video Encoder Firmware with a CVSS 3.x base score of 9.8. Its EPSS exploit-prediction score of 35% places it in the 98th percentile, indicating an elevated likelihood of exploitation.

Key facts

Description

An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can send a crafted unauthenticated RTSP request to cause a buffer overflow and application crash. The device will not be able to perform its main purpose of video encoding and streaming for up to a minute, until it automatically reboots. Attackers can send malicious requests once a minute, effectively disabling the device.

Frequently asked questions

What is CVE-2020-24214?
An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can send a crafted unauthenticated RTSP request to cause a buffer overflow and application crash. The device will not be able to perform its main purpose of video encoding and streaming for up to a minute, until it automatically reboots. Attackers can send malicious requests once a minute, effectively disabling the device.
How severe is CVE-2020-24214?
CVE-2020-24214 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2020-24214 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 35% (98th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-24214?
CVE-2020-24214 primarily affects Szuray Iptv/h.264 Video Encoder Firmware. In total, 7 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2020-24214?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2020-24214 published?
CVE-2020-24214 was published on 2020-10-06 and last updated on 2026-06-17.

References

Affected products (7)

More vulnerabilities in Szuray Iptv/h.264 Video Encoder Firmware

All CVEs affecting Szuray Iptv/h.264 Video Encoder Firmware →