CVE-2020-24219
📋 TL;DR
CVE-2020-24219 is an unauthenticated path traversal vulnerability in URayTech/HiSilicon video encoders that allows attackers to read any file from the device's file system. This includes configuration files containing administrative passwords in cleartext. Organizations using affected video encoders in security or surveillance systems are at risk.
💻 Affected Systems
- URayTech IPTV/H.264/H.265 video encoders
- HiSilicon-based video encoders
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full administrative access to video encoders, potentially compromising entire surveillance systems, exfiltrating sensitive video footage, or using devices as network pivots.
Likely Case
Attackers steal administrative credentials and configuration files, enabling unauthorized access to video streams and device management interfaces.
If Mitigated
Attackers can only enumerate files but cannot access critical systems due to network segmentation and authentication controls.
🎯 Exploit Status
Multiple public exploit scripts and detailed technical analysis available. Simple HTTP requests with path traversal payloads can retrieve files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
1. Contact URayTech/HiSilicon for firmware updates
2. If updates unavailable, implement network-level mitigations
3. Consider replacing affected devices with patched alternatives
🔧 Temporary Workarounds
Network Access Control
allRestrict access to the encoder's management interface (typically port 80/443) to trusted networks only
Web Application Firewall Rules
allBlock path traversal patterns in HTTP requests to the encoder
# Example WAF rule to block ../ patterns
SecRule REQUEST_URI "\.\./" "id:1001,phase:1,deny,status:403,msg:'Path Traversal Attempt'
🧯 If You Can't Patch
- Isolate affected encoders in separate VLAN with strict firewall rules
- Change administrative passwords and monitor for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Send HTTP GET request to encoder: http://<encoder-ip>/../../../../etc/passwd and check if file contents are returnedCheck Version:
Check web interface login page or system info page for firmware version (typically displays 1.97 or earlier)Verify Fix Applied:
Attempt the same path traversal request after mitigations - should receive 403/404 error instead of file contents📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing ../ patterns
- Multiple failed authentication attempts after file disclosure
- Access to configuration files from unusual IPs
Network Indicators:
- HTTP GET requests with excessive ../ sequences
- Traffic to encoder management interface from external IPs
SIEM Query:
source="encoder-web.log" AND (uri="*../*" OR uri="*..\\*" OR status=200 AND uri="*/etc/*")🔗 References
- http://packetstormsecurity.com/files/159595/HiSilicon-Video-Encoder-1.97-File-Disclosure-Path-Traversal.html
- https://kojenov.com/2020-09-15-hisilicon-encoder-vulnerabilities/
- https://www.kb.cert.org/vuls/id/896979
- http://packetstormsecurity.com/files/159595/HiSilicon-Video-Encoder-1.97-File-Disclosure-Path-Traversal.html
- https://kojenov.com/2020-09-15-hisilicon-encoder-vulnerabilities/
- https://www.kb.cert.org/vuls/id/896979
