CVE-2017-20220

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2017-20220", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-03-15T17:44:46.544Z", "datePublished": "2026-03-15T18:34:28.354Z", "dateUpdated": "2026-03-16T14:20:17.530Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-03-15T18:34:28.354Z"}, "datePublic": "2017-05-03T00:00:00.000Z", "title": "Serviio PRO 1.8 Unauthenticated Password Change via REST API", "descriptions": [{"lang": "en", "value": "Serviio PRO 1.8 contains an improper access control vulnerability in the Configuration REST API that allows unauthenticated attackers to change the mediabrowser login password. Attackers can send specially crafted requests to the REST API endpoints to modify credentials without authentication."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Missing Authentication for Critical Function", "cweId": "CWE-306", "type": "CWE"}]}], "affected": [{"vendor": "Serviio", "product": "Serviio PRO", "versions": [{"version": "1.8.0.0 PRO", "status": "affected"}, {"version": "1.7.1", "status": "affected"}, {"version": "1.7.0", "status": "affected"}, {"version": "1.6.1", "status": "affected"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5407.php", "name": "Zero Science Lab Disclosure", "tags": ["third-party-advisory"]}, {"url": "https://blogs.securiteam.com/index.php/archives/3094", "name": "SecuriTeam Blogs", "tags": ["third-party-advisory"]}, {"url": "https://www.exploit-db.com/exploits/41960/", "name": "Exploit-DB", "tags": ["exploit"]}, {"url": "https://packetstormsecurity.com/files/142386", "name": "Packet Storm Security", "tags": ["exploit"]}, {"url": "https://cxsecurity.com/issue/WLB-2017050025", "name": "CXSecurity", "tags": ["third-party-advisory"]}, {"url": "http://www.securitylab.ru/poc/486047.php", "name": "SecurityLab", "tags": ["third-party-advisory"]}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/125645", "name": "IBM X-Force Exchange", "tags": ["vdb-entry"]}, {"name": "VulnCheck Advisory: Serviio PRO 1.8 Unauthenticated Password Change via REST API", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/serviio-pro-unauthenticated-password-change-via-rest-api"}], "credits": [{"lang": "en", "value": "LiquidWorm as Gjoko Krstic of Zero Science Lab", "type": "finder"}], "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2017-20220", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-16T14:10:13.628907Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T14:20:17.530Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Serviio PRO 1.8 Unauthenticated Password Change via REST API", "credits": [{"lang": "en", "type": "finder", "value": "LiquidWorm as Gjoko Krstic of Zero Science Lab"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Serviio", "product": "Serviio PRO", "versions": [{"status": "affected", "version": "1.8.0.0 PRO"}, {"status": "affected", "version": "1.7.1"}, {"status": "affected", "version": "1.7.0"}, {"status": "affected", "version": "1.6.1"}]}], "datePublic": "2017-05-03T00:00:00.000Z", "references": [{"url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5407.php", "name": "Zero Science Lab Disclosure", "tags": ["third-party-advisory"]}, {"url": "https://blogs.securiteam.com/index.php/archives/3094", "name": "SecuriTeam Blogs", "tags": ["third-party-advisory"]}, {"url": "https://www.exploit-db.com/exploits/41960/", "name": "Exploit-DB", "tags": ["exploit"]}, {"url": "https://packetstormsecurity.com/files/142386", "name": "Packet Storm Security", "tags": ["exploit"]}, {"url": "https://cxsecurity.com/issue/WLB-2017050025", "name": "CXSecurity", "tags": ["third-party-advisory"]}, {"url": "http://www.securitylab.ru/poc/486047.php", "name": "SecurityLab", "tags": ["third-party-advisory"]}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/125645", "name": "IBM X-Force Exchange", "tags": ["vdb-entry"]}, {"url": "https://www.vulncheck.com/advisories/serviio-pro-unauthenticated-password-change-via-rest-api", "name": "VulnCheck Advisory: Serviio PRO 1.8 Unauthenticated Password Change via REST API", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "Serviio PRO 1.8 contains an improper access control vulnerability in the Configuration REST API that allows unauthenticated attackers to change the mediabrowser login password. Attackers can send specially crafted requests to the REST API endpoints to modify credentials without authentication."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-03-15T18:34:28.354Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2017-20220", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-16T14:10:13.628907Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-03-16T14:17:09.975Z"}}]}, "cveMetadata": {"cveId": "CVE-2017-20220", "state": "PUBLISHED", "dateUpdated": "2026-03-15T18:34:28.354Z", "dateReserved": "2026-03-15T17:44:46.544Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-03-15T18:34:28.354Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Serviio PRO", "vendor": "Serviio", "versions": [{"status": "affected", "version": "1.8.0.0 PRO"}, {"status": "affected", "version": "1.7.1"}, {"status": "affected", "version": "1.7.0"}, {"status": "affected", "version": "1.6.1"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Serviio PRO 1.8 contains an improper access control vulnerability in the Configuration REST API that allows unauthenticated attackers to change the mediabrowser login password. Attackers can send specially crafted requests to the REST API endpoints to modify credentials without authentication."}, {"lang": "es", "value": "Serviio PRO 1.8 contiene una vulnerabilidad de control de acceso inadecuado en la API REST de Configuraci\u00f3n que permite a atacantes no autenticados cambiar la contrase\u00f1a de inicio de sesi\u00f3n del mediabrowser. Los atacantes pueden enviar solicitudes especialmente dise\u00f1adas a los puntos finales de la API REST para modificar credenciales sin autenticaci\u00f3n."}], "id": "CVE-2017-20220", "lastModified": "2026-06-17T01:15:26.440", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2017-20220", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-16T14:10:13.628907Z", "version": "2.0.3"}}]}, "published": "2026-03-16T14:17:51.730", "references": [{"source": "disclosure@vulncheck.com", "url": "http://www.securitylab.ru/poc/486047.php"}, {"source": "disclosure@vulncheck.com", "url": "https://blogs.securiteam.com/index.php/archives/3094"}, {"source": "disclosure@vulncheck.com", "url": "https://cxsecurity.com/issue/WLB-2017050025"}, {"source": "disclosure@vulncheck.com", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/125645"}, {"source": "disclosure@vulncheck.com", "url": "https://packetstormsecurity.com/files/142386"}, {"source": "disclosure@vulncheck.com", "url": "https://www.exploit-db.com/exploits/41960/"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/serviio-pro-unauthenticated-password-change-via-rest-api"}, {"source": "disclosure@vulncheck.com", "url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5407.php"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.8.0.0 PRO"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.7.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.7.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "1.6.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Serviio PRO", "source": "cna", "vendor": "Serviio"}, "product": "serviio_pro", "vendor": "serviio"}], "analysis": {"en": {"generated_at": "2026-03-21T14:35:53.306002+00:00", "value": {"mitigation_remediation": ["Immediately change all Serviio administrative passwords and regenerate any credentials used by remote services.", "Restrict network access to the Serviio REST API using firewall or host\u2011based controls so that only trusted IP addresses can reach the endpoints.", "Install the latest Serviio PRO release available from the vendor, which includes a fix for this issue.", "Configure the service to use HTTPS with a strong TLS configuration to reduce the risk of credential interception.", "Enable auditing and monitor logs for suspicious REST API activity to detect any attempts to exploit this flaw."], "summary": {"action": "Immediate Patch", "impact": "Unauthenticated Password Change"}, "threat_synthesis": {"affected_systems": "The affected product is Serviio PRO version 1.8. No other versions or product variants are listed as impacted. Users running this specific version of the application are therefore exposed, regardless of their network environment or host configuration.\n", "description_and_impact": "Serviio PRO 1.8 contains an improper access control flaw in its REST configuration API that allows an attacker to send crafted requests and modify the media browser administrative password without any form of authentication. Because the API endpoint accepts password change commands without verifying the caller, the vulnerability leaves the service susceptible to unauthorized takeover of administrative credentials, effectively granting configuration control and potential access to all media content. The weakness is classified as CWE\u2011306, improper neutralization of authentication and authorization controls, and can be leveraged to gain persistent privileged access. The impact is that an attacker can fully control the Serviio instance by resetting or stealing its administrator credentials, enabling further exploitation of the media server or lateral movement within the network.\n", "risk_and_exploitability": "The CVSS base score of 8.7 indicates high severity, while the EPSS score of less than 1\u202f% suggests a relatively low probability of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog, but publicly available proof\u2011of\u2011concept exploits and detailed advisories demonstrate that attack tools could be constructed. The likely attack vector is a remote network connection to the exposed REST API over HTTP or HTTPS; an attacker can trigger the password change by sending a specially crafted HTTP request without any authentication token. If successful, they can immediately assume administrative privileges, which may allow further compromise of the host or exploitation of other services.\n"}}}}, "created": "2026-03-16T09:21:00.558674+00:00", "updated": "2026-03-23T14:01:19.146792+00:00", "vendors": ["serviio", "serviio$PRODUCT$serviio_pro"]}