LiveActive security incident?Get immediate response
CVE Record

CVE-2020-24918: A buffer overflow in the RTSP service of the Ambarella Oryx RTSP Server 2020-01-07 allows an unauthenticate...

A buffer overflow in the RTSP service of the Ambarella Oryx RTSP Server 2020-01-07 allows an unauthenticated attacker to send a crafted RTSP request, with a long digest authentication header, to execute arbitrary code in parse_authentication_header() in libamprotocol-rtsp.so.1 in rtsp_svc (or cause a crash). This allows remote takeover of a Furbo Dog Camera, for example. NOTE: The vendor states that the RTSP library is used for DEMO only, using it in product is a customer's behavior. Ambarella has emphasized that RTSP is DEMO only library, should NOT be used in product in our document. Because Ambarella's SDK is proprietary, we didn't publish our SDK source code in public network.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This is a remotely reachable memory corruption flaw in Ambarella’s Oryx RTSP demo server from 2020-01-07. An unauthenticated attacker could crash the RTSP service or potentially take over devices using that library in products, with Furbo Dog Camera cited as an example. Public data does not provide CVSS, complete affected product inventory, or a confirmed fix.

Executive priority

Treat this as a high-priority IoT exposure question, not a generic server patch. The worst case is remote device takeover, but the impacted product set is poorly defined. Focus first on internet-facing cameras or embedded video systems, then confirm vendor support status and isolation controls.

Technical view

CVE-2020-24918 is a buffer overflow in parse_authentication_header() within libamprotocol-rtsp.so.1 used by rtsp_svc. The described trigger is an overlong digest authentication header in an RTSP request. Impact is arbitrary code execution or service crash. Ambarella states the RTSP library was demo-only and not intended for product use.

Likely exposure

Exposure is limited to products that embedded Ambarella Oryx RTSP Server 2020-01-07 or the referenced demo RTSP library and expose RTSP. The source bundle’s affected-product metadata is listed as n/a, so organizations need device-level and firmware-level confirmation rather than relying on CPE matching.

Exploitation context

The CVE description says exploitation is unauthenticated and remote against RTSP, but the bundle does not cite CISA KEV listing or confirmed active exploitation. A public research reference discusses Furbo camera hacking, but this assessment should not assume broad in-the-wild exploitation from the provided evidence.

Researcher notes

Key gaps are absent CVSS, no CWE assignment, n/a affected metadata, and no fix details in the bundle. Ambarella disputes product-use responsibility by describing the RTSP library as demo-only. Validate embedded usage through firmware analysis and vendor confirmation before declaring specific products affected.

Mitigation direction

  • Identify devices running Ambarella Oryx RTSP Server 2020-01-07 or libamprotocol-rtsp.so.1.
  • Check vendor and OEM advisories for firmware updates or replacement guidance.
  • Disable RTSP where it is not required for business operations.
  • Restrict RTSP access to trusted management networks or VPN paths.
  • Prioritize internet-facing cameras and IoT devices for review.

Validation and detection

  • Inventory RTSP-exposed assets, including cameras and embedded video devices.
  • Review firmware bills of materials for Ambarella Oryx RTSP components.
  • Confirm whether libamprotocol-rtsp.so.1 exists in device firmware images.
  • Check whether RTSP is reachable from untrusted networks.
  • Document vendor responses where product status is unclear.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2020-24918 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.