CVE-2020-24918

A buffer overflow in the RTSP service of the Ambarella Oryx RTSP Server 2020-01-07 allows an unauthenticated attacker to send a crafted RTSP request, with a long digest authentication header, to execute arbitrary code in parse_authentication_header() in libamprotocol-rtsp.so.1 in rtsp_svc (or cause a crash). This allows remote takeover of a Furbo Dog Camera, for example. NOTE: The vendor states that the RTSP library is used for DEMO only, using it in product is a customer's behavior. Ambarella has emphasized that RTSP is DEMO only library, should NOT be used in product in our document. Because Ambarella's SDK is proprietary, we didn't publish our SDK source code in public network.

• CWE-120

• https://github.com/Ambarella-Inc/amba-cve-info/tree/main/cve-2020-24918
• https://somersetrecon.squarespace.com/blog/2021/hacking-the-furbo-part-1Exploit, Third Party Advisory
• https://www.ambarella.comVendor Advisory
• https://www.somersetrecon.com/blogExploit, Third Party Advisory
• https://somersetrecon.squarespace.com/blog/2021/hacking-the-furbo-part-1Exploit, Third Party Advisory
• https://www.ambarella.comVendor Advisory
• https://www.somersetrecon.com/blogExploit, Third Party Advisory

Published

Apr 30, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-2491This cross-site scripting vulnerability in Photo Station all…6.1
• CVE-2020-24912A reflected cross-site scripting (XSS) vulnerability in qcub…6.1
• CVE-2020-24913A SQL injection vulnerability in qcubed (all versions includ…9.8
• CVE-2020-24914A PHP object injection bug in profile.php in qcubed (all ver…9.8
• CVE-2020-24916CGI implementation in Yaws web server versions 1.81 to 2.0.7…9.8
• CVE-2020-24917osTicket before 1.14.3 allows XSS via a crafted filename to …6.1
• CVE-2020-2492If exploited, the command injection vulnerability could allo…7.2
• CVE-2020-24922Cross Site Request Forgery (CSRF) vulnerability in xxl-job-a…8.8
• CVE-2020-24924A Persistent Cross-site Scripting vulnerability is found in …5.4
• CVE-2020-24925A Sensitive Source Code Path Disclosure vulnerability is fou…7.5
• CVE-2020-24928managers/socketManager.ts in PreMiD through 2.1.3 has a loca…5.3
• CVE-2020-2493This cross-site scripting vulnerability in Multimedia Consol…6.1