CVE-2020-24219

Name of the Vulnerable Software and Affected Versions URayTech IPTV/H.264/H.265 video encoders versions through 1.97

Description An issue allows attackers to send crafted unauthenticated HTTP requests to exploit path traversal and pattern-matching programming flaws. This enables retrieval of any file from the device's file system, including the configuration file containing the cleartext administrative password.

Recommendations For versions through 1.97, update to a version that addresses the path traversal and pattern-matching programming flaws to prevent exploitation. As a temporary workaround, consider restricting access to the device's file system and limiting the use of HTTP requests until a patch is available.