CVE-2020-24755

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In Ubiquiti UniFi Video v3.10.13, when the executable starts, its first library validation is in the current directory. This allows the impersonation and modification of the library to execute code on the system. This was tested in (Windows 7 x64/Windows 10 x64).

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

No affected versions have been published.

Timeline

Published
May 17, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-247657.5InterMind iMind Server through 3.13.65 allows remote unauthenticated attackers to read the self-diagnostic archive via a direct api/rs/monitCVE-2020-247699.8SQL injection vulnerability in takeconfirm.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the classes parCVE-2020-247709.8SQL injection vulnerability in modrules.php in NexusPHP 1.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.CVE-2020-247717.5Incorrect access control in NexusPHP 1.5.beta5.20120707 allows unauthorized attackers to access published content.CVE-2020-247728.8In Dreamacro Clash for Windows v0.11.4, an attacker could embed a malicious iframe in a website with a crafted URL that would launch the ClaCVE-2020-247869.8An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService CVE-2020-247919.8FUEL CMS 1.4.8 allows SQL injection via the 'fuel_replace_id' parameter in pages/replace/1. Exploiting this issue could allow an attacker toCVE-2020-247946.1Cross Site Scripting (XSS) vulnerability in Kentico before 12.0.75.CVE-2020-248046.5Plaintext Password vulnerability in AddAdmin.py in cms-dev/cms v1.4.rc1, allows attackers to gain sensitive information via audit logs.CVE-2020-248077.8The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execuCVE-2020-248156.5A Server-Side Request Forgery (SSRF) affecting the PDF generation in MicroStrategy 10.4, 2019 before Update 6, and 2020 before Update 2 alloCVE-2020-248215.5A vulnerability in the dwarf::cursor::skip_form function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segm
CVE-2020-24755: High severity, CVSS 7.8 | Vulnix