CVE-2020-24918

CVE-2020-24918 describes a critical buffer overflow vulnerability in the Ambarella Oryx RTSP Server, specifically within its RTSP service. This flaw allows an unauthenticated attacker to execute arbitrary code or cause a denial of service by sending a specially crafted RTSP request with an overly long digest authentication header. While the vendor states this RTSP library is for demonstration purposes only, its use in products like the Furbo Dog Camera has been observed, enabling remote takeover. The vulnerability carries a CVSS score of 9.8 (Critical), indicating a severe risk due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. It requires no user interaction or privileges to exploit. Currently, there is no evidence of active exploitation (KEV list), nor are there publicly available Metasploit, Nuclei, or ExploitDB modules. Despite this, the vulnerability has garnered significant community discussion, with 10 mentions, suggesting awareness and potential interest in developing exploits.