CVE-2024-27488
About
Incorrect Access Control vulnerability in ZLMediaKit versions 1.0 through 8.0, allows remote attackers to escalate privileges and obtain sensitive information. The application system enables the http API interface by default and uses the secret parameter method to authenticate the http restful api interface, but the secret is hardcoded by default.
Rainforest analyst review
ZLMediaKit ships with its HTTP API turned on by default and guards that API with a shared secret that is itself hardcoded to a known default value. Anyone who reaches the interface and supplies the built-in secret is authenticated, which means an unauthenticated attacker in practice: the 'secret' is public knowledge, so there is effectively no authentication at all.
Default-credential and hardcoded-secret bugs are botnet fuel because they're trivially scriptable and need no exploit development, just a request carrying the known value. Media servers are also attractive: they sit on networks with cameras and streams, and API control can mean privilege escalation and access to sensitive feeds. Anything left at defaults and reachable is essentially open.
Our angle is detection and exposure combined. We hunt for ZLMediaKit instances answering on their default API and confirm whether the operator ever rotated that secret, because the fix is as much configuration as it is upgrade. Where an instance is internet-reachable and still on the default, we treat it as already-exposed and pull it behind access controls immediately rather than trusting the built-in secret to gate anything.
References
Related CVEs
No related CVEs.
Frequently asked questions
What is CVE-2024-27488?
Incorrect Access Control vulnerability in ZLMediaKit versions 1.0 through 8.0, allows remote attackers to escalate privileges and obtain sensitive information. The application system enables the http API interface by default and uses the secret parameter method to authenticate the http restful api interface, but the secret is hardcoded by default.
How severe is CVE-2024-27488?
CVE-2024-27488 carries a CVSS 3.1 base score of 9.8, rated critical. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 99 out of 100, in the critical band.
How is CVE-2024-27488 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): attack vector Network, attack complexity Low, privileges required None, user interaction None. Impact on confidentiality High, integrity High and availability High.
How do I fix CVE-2024-27488?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.