CVE-2024-52052

Name of the Vulnerable Software and Affected Versions Wowza Streaming Engine versions prior to 4.9.1

Description The issue is related to insufficient input validation in Wowza Streaming Engine, which can be exploited by a remote attacker to execute arbitrary code. An authenticated Streaming Engine Manager administrator can define a custom application property and poison a stream target for high-privilege remote code execution. The vulnerability exposes thousands of servers to attack.

Recommendations For Wowza Streaming Engine versions prior to 4.9.1, update to version 4.9.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the Streaming Engine Manager to minimize the risk of exploitation. Avoid using custom application properties and stream targets until the issue is resolved.