CVE-2017-20220

8.7 highEPSS 0.4%

High (8.7). EPSS 0.4% chance of exploitation in the next 30 days.

Serviio PRO 1.8 contains an improper access control vulnerability in the Configuration REST API that allows unauthenticated attackers to change the mediabrowser login password. Attackers can send specially crafted requests to the REST API endpoints to modify credentials without authentication.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 34% of CVEs (scores of 2026-10-31)
CWE: CWE-306
Published: 2026-03-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

http://www.securitylab.ru/poc/486047.php
https://blogs.securiteam.com/index.php/archives/3094
https://cxsecurity.com/issue/WLB-2017050025
https://exchange.xforce.ibmcloud.com/vulnerabilities/125645
https://packetstormsecurity.com/files/142386

Check your stack JSON