Vulnerability · Published Nov 26, 2021 · Assigned by krcert
CVE-2020-7881AfreecaTV streamer service stack-based buffer overflow
High 7.5
In plain English
A high-severity integer overflow in afreecatvstreamer.exe from AfreecaTV. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.4%top 26.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The vulnerability function is enabled when the streamer service related to the AfreecaTV communicated through web socket using 21201 port. A stack-based buffer overflow leading to remote code execution was discovered in strcpy() operate by "FanTicket" field. It is because of stored data without validation of length.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| AfreecaTV | afreecatvstreamer.exe | 1.0.0.1 – through 2020.06.15 |
Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H