https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-24217.htmlhttps://patchthecve.com/cve/CVE-2020-24217.htmlWed, 17 Jun 2026 03:05:18 +0000CRITICAL 9.8: An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. The file-upload endpoint does not enforce authentication. Attackers can send an unauthenticated HTTP request to upload a custom firmware component, possibly in conjunction with command injection, to achttps://patchthecve.com/cve/CVE-2020-24216.htmlhttps://patchthecve.com/cve/CVE-2020-24216.htmlWed, 17 Jun 2026 03:05:18 +0000HIGH 7.5: An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. When the administrator configures a secret URL for RTSP streaming, the stream is still available via its default name such as /0. Unauthenticated attackers can view video streams that are meant to be phttps://patchthecve.com/cve/CVE-2020-24215.htmlhttps://patchthecve.com/cve/CVE-2020-24215.htmlWed, 17 Jun 2026 03:05:18 +0000CRITICAL 9.8: An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can use hard-coded credentials in HTTP requests to perform any administrative task on the device including retrieving the device's configuration (with the cleartext admin password), and uploahttps://patchthecve.com/cve/CVE-2020-24214.htmlhttps://patchthecve.com/cve/CVE-2020-24214.htmlWed, 17 Jun 2026 03:05:18 +0000CRITICAL 9.8: An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. Attackers can send a crafted unauthenticated RTSP request to cause a buffer overflow and application crash. The device will not be able to perform its main purpose of video encoding and streaming for u