CVE-2022-32761: medium-severity vulnerability in WWBN AVideo
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
AVideo 11.6 has a flaw that allows attackers to read files from the server by sending specially crafted HTTP requests to the video encoder function. This exposes sensitive information stored on the server.
An information disclosure vulnerability in the aVideoEncoderReceiveImage endpoint allows unauthenticated or low-privileged attackers to read arbitrary files via specially-crafted HTTP requests. The vulnerability affects WWBN AVideo 11.6 and dev master, enabling file enumeration and exfiltration of sensitive data without authentication requirements.
In the same product, most dangerous first.