CVE-2016-20033
Plain English Summary
AI-powered analysis for quick understanding
This vulnerability allows an attacker with access to the Wowza Streaming Engine to replace important executable files with malicious ones, giving them the ability to run code with full system privileges when the services restart. The attacker can exploit this due to overly permissive file settings that let anyone modify these files.
Technical Description
Wowza Streaming Engine 4.5.0 contains a local privilege escalation vulnerability that allows authenticated users to escalate privileges by replacing executable files due to improper file permissions granting full access to the Everyone group. Attackers can replace the nssm_x64.exe binary in the manager and engine service directories with malicious executables to execute code with LocalSystem privileges when services restart.
CVSS Vector Analysis
Vector String
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XExploit Resources
Search for proof-of-concept code and exploit modules
Official References
Quick Information
Published
Mar 16, 2026
22 days ago
Last Modified
Mar 19, 2026
19 days ago
Vendor
wowza
Product
streaming engine
Related Vulnerabilities
An attacker can inject harmful scripts into the Wowza Streaming Engine's management interface, allowing them to execute malicious code in a user's browser session. This vulnerability requires the attacker to manipulate specific input parameters, potentially tricking users into clicking on a link or visiting a page that exploits the flaw.
This vulnerability allows attackers to create new admin accounts with any credentials by tricking logged-in administrators into visiting a malicious website. The attacker needs the administrator to be logged in to the Wowza Streaming Engine while visiting the malicious site, which then submits unauthorized requests on their behalf.
This vulnerability allows an attacker with a read-only user account to gain full administrative access to the Wowza Streaming Engine by tricking the system into thinking they have higher privileges. The attacker simply needs to send a specially crafted request to the server, changing certain parameters to elevate their access level.