CVE-2020-24219

An issue was discovered on URayTech IPTV/H.264/H.265 video encoders through 1.97. Attackers can send crafted unauthenticated HTTP requests to exploit path traversal and pattern-matching programming flaws, and retrieve any file from the device's file system, including the configuration file with the cleartext administrative password.

• CWE-22

• http://packetstormsecurity.com/files/159595/HiSilicon-Video-Encoder-1.97-File-Disclosure-Path-Traversal.htmlExploit, Third Party Advisory, VDB Entry
• https://kojenov.com/2020-09-15-hisilicon-encoder-vulnerabilities/Exploit, Third Party Advisory
• https://www.kb.cert.org/vuls/id/896979Third Party Advisory, US Government Resource
• http://packetstormsecurity.com/files/159595/HiSilicon-Video-Encoder-1.97-File-Disclosure-Path-Traversal.htmlExploit, Third Party Advisory, VDB Entry
• https://kojenov.com/2020-09-15-hisilicon-encoder-vulnerabilities/Exploit, Third Party Advisory
• https://www.kb.cert.org/vuls/id/896979Third Party Advisory, US Government Resource

Published

Oct 6, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-24213An integer overflow was discovered in YGOPro ygocore v13.51.…7.5
• CVE-2020-24214An issue was discovered in the box application on HiSilicon …9.8
• CVE-2020-24215An issue was discovered in the box application on HiSilicon …9.8
• CVE-2020-24216An issue was discovered in the box application on HiSilicon …7.5
• CVE-2020-24217An issue was discovered in the box application on HiSilicon …9.8
• CVE-2020-24218An issue was discovered on URayTech IPTV/H.264/H.265 video e…9.8
• CVE-2020-24220ShopXO v1.8.1 has a command execution vulnerability. Attacke…8.8
• CVE-2020-24221An issue was discovered in GetByte function in miniupnp ngif…5.5
• CVE-2020-24222Buffer Overflow vulnerability in jfif_decode() function in r…7.8
• CVE-2020-24223Mara CMS 7.5 allows cross-site scripting (XSS) in contact.ph…6.1
• CVE-2020-24227Playground Sessions v2.5.582 (and earlier) for Windows, stor…7.5
• CVE-2020-24231Symmetric DS <3.12.0 uses mx4j to provide access to JMX over…9.8