CVE-2017-20220
Published: 16 March 2026
Summary
CVE-2017-20220 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Securitylab (inferred from references). Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
Serviio PRO 1.8 is affected by CVE-2017-20220, an improper access control vulnerability (CWE-306) in its Configuration REST API. This flaw allows unauthenticated attackers to modify the mediabrowser login password by sending specially crafted requests to the API endpoints without any authentication requirements. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), highlighting its potential for high confidentiality impact.
Remote, unauthenticated attackers can exploit this vulnerability over the network with low attack complexity and no user interaction or privileges needed. By targeting the REST API endpoints with crafted requests, they can alter mediabrowser credentials, enabling subsequent unauthorized access to protected media browsing features.
Advisories and proof-of-concept details are documented in references such as SecurityLab, SecuriTeam blogs, CXSecurity, IBM X-Force Exchange, and PacketStorm, though specific patch or mitigation guidance is not detailed in the primary CVE information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2017-18934
Vulnerability details
Serviio PRO 1.8 contains an improper access control vulnerability in the Configuration REST API that allows unauthenticated attackers to change the mediabrowser login password. Attackers can send specially crafted requests to the REST API endpoints to modify credentials without authentication.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated exploitation of public REST API (T1190) to manipulate account credentials (T1098).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates identification and limitation of actions permitted without authentication, preventing unauthenticated changes to mediabrowser credentials via the REST API.
Enforces approved authorizations for access to system resources, blocking unauthenticated attackers from modifying passwords through crafted API requests.
Requires identification and authentication for non-organizational users accessing the system, mitigating remote unauthenticated exploitation of the Configuration REST API.