Cyber Resilience

CVE-2024-52052

Wowza Streaming Engine 4.3.0 – 4.9.1

Published
21 November 2024
Modified
26 February 2025
CVSS Score v4 9.4
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0048 39th percentile
Risk Priority 37 floored blend · peak EPSS

Summary

CVE-2024-52052 is a critical-severity Reliance on File Name or Extension of Externally-Supplied File (CWE-646) vulnerability in Wowza Streaming Engine. Its CVSS base score is 9.4 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Double File Extension (T1036.007); ranked at the 39th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability Data

Wowza Streaming Engine below 4.9.1 permits an authenticated Streaming Engine Manager administrator to define a custom application property and poison a stream target for high-privilege remote code execution.

CWE(s)
CWE-646NVD-CWE-Other

Related Threats

MITRE ATT&CK Enterprise Techniques

T1036.007 Double File Extension Stealth
Adversaries may abuse a double extension in the filename as a means of masquerading the true file type.
attack.mitre.org →
T1036 Masquerading Stealth
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.
attack.mitre.org →
T1036.002 Right-to-Left Override Stealth
Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign.
attack.mitre.org →
T1036.006 Space after Filename Stealth
Adversaries can hide a program's true filetype by changing the extension of a file.
attack.mitre.org →
T1036.008 Masquerade File Type Stealth
Adversaries may masquerade malicious payloads as legitimate files through changes to the payload's formatting, including the file’s signature, extension, icon, and contents.
attack.mitre.org →
T1505 Server Software Component Persistence
Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-52056Same product: Linux Linux Kernel
CVE-2024-52055Same product: Linux Linux Kernel
CVE-2024-52053Same product: Linux Linux Kernel
CVE-2024-52054Same product: Linux Linux Kernel
CVE-2026-20172Shared CWE-646
CVE-2025-58449Shared CWE-646
CVE-2025-41720Shared CWE-646
CVE-2025-30662Shared CWE-646
CVE-2025-1889Shared CWE-646
CVE-2021-26828Same product: Linux Linux Kernel

Affected Assets

wowza
streaming engine
4.3.0 — 4.9.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match

Requires validation of information inputs, which structurally stops reliance on untrusted file names or extensions by forcing content-based checks.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require content-based validation instead of trusting file extensions for externally supplied files.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect the weakness, but the control does not guarantee its elimination.

A.8.19 Installation of software on operational systems partial match
degrades

Restricting software installation can limit dangerous file types but does not enforce content-based validation.

A.8.23 Web filtering partial match
degrades

Web filtering can block risky file extensions but does not address server-side file handling logic.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC requires proper file-type validation, directly mitigating reliance on untrusted names or extensions.

A.8.26 Application security requirements partial match
prevents

Application security requirements can mandate content inspection, but the control itself does not prescribe the technique.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles encourage safe file handling, yet the control is broader than this specific weakness.

References