CVE-2016-20033

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-20033
Wowza Streaming Engine 4.5.0 contains a local privilege escalation vulnerability that allows authenticated users to escalate privileges by replacing executable files due to improper file permissions granting full access to the Everyone group. Attackers can replace the nssm_x64.exe binary in the manager and engine service directories with malicious executables to execute code with LocalSystem privileges when services restart.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5339.php Exploit Third Party Advisory
https://www.exploit-db.com/exploits/40132 Exploit Third Party Advisory VDB Entry
https://www.vulncheck.com/advisories/wowza-streaming-engine-local-privilege-escalation-via-nssm-x64-exe Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:wowza:streaming_engine:4.5.0:*:*:*:*:*:*:*
History

19 Mar 2026, 14:16

Type Values Removed Values Added
First Time Wowza
Wowza streaming Engine
References () http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5339.php - () http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5339.php - Exploit, Third Party Advisory
References () https://www.exploit-db.com/exploits/40132 - () https://www.exploit-db.com/exploits/40132 - Exploit, Third Party Advisory, VDB Entry
References () https://www.vulncheck.com/advisories/wowza-streaming-engine-local-privilege-escalation-via-nssm-x64-exe - () https://www.vulncheck.com/advisories/wowza-streaming-engine-local-privilege-escalation-via-nssm-x64-exe - Third Party Advisory
Summary
  • (es) Wowza Streaming Engine 4.5.0 contiene una vulnerabilidad de escalada de privilegios local que permite a los usuarios autenticados escalar privilegios reemplazando archivos ejecutables debido a permisos de archivo incorrectos que otorgan acceso total al grupo Everyone. Los atacantes pueden reemplazar el binario nssm_x64.exe en los directorios de servicio del administrador y del motor con ejecutables maliciosos para ejecutar código con privilegios de LocalSystem cuando los servicios se reinician.
CPE cpe:2.3:a:wowza:streaming_engine:4.5.0:*:*:*:*:*:*:*

16 Mar 2026, 14:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-16 14:17

Updated : 2026-03-19 14:16

NVD link : CVE-2016-20033

Mitre link : CVE-2016-20033

CVE.ORG link : CVE-2016-20033

JSON object : View

Products Affected

wowza

  • streaming_engine
CWE
CWE-639

Authorization Bypass Through User-Controlled Key