CVE-2024-56808 in Media Streaming add-on
Summary
by MITRE • 02/11/2026
A command injection vulnerability has been reported to affect Media Streaming add-on. If an attacker gains local network access who have also gained a user account, they can then exploit the vulnerability to execute arbitrary commands.
We have already fixed the vulnerability in the following version: Media Streaming add-on 500.1.1.6 ( 2024/08/02 ) and later
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 02/12/2026
This command injection vulnerability in the Media Streaming add-on represents a critical security flaw that enables remote code execution when combined with local network access and valid user credentials. The vulnerability exists within the add-on's processing of user-supplied input that is not properly sanitized or validated before being executed as system commands. Attackers exploiting this weakness can leverage their authenticated session to inject malicious commands that will be executed with the privileges of the affected service account, potentially leading to complete system compromise. The vulnerability falls under the CWE-77 category of command injection, which is classified as a high-severity issue due to its potential for arbitrary code execution and privilege escalation. According to ATT&CK framework, this vulnerability maps to T1059.001 for command and scripting interpreter and T1068 for local privilege escalation, as the initial compromise requires user account access but can lead to elevated system privileges.
The technical implementation of this vulnerability stems from improper input validation and sanitization within the Media Streaming add-on's command execution mechanisms. When legitimate users submit commands or parameters through the add-on interface, the system fails to adequately filter or escape special characters that could be interpreted by the underlying operating system shell. This allows attackers to inject malicious shell commands that bypass normal input restrictions and execute with the same privileges as the streaming service. The vulnerability is particularly concerning because it requires only a valid user account and local network access, which are often easier to obtain than direct system access. The attack surface is expanded when the add-on runs with elevated privileges or when the user account has sufficient permissions to perform administrative functions.
The operational impact of this vulnerability extends beyond simple command execution to encompass potential data exfiltration, system reconnaissance, and persistent access establishment. An attacker who successfully exploits this vulnerability could install backdoors, modify system configurations, access sensitive media files, or use the compromised system as a pivot point for attacking other networked devices. The Media Streaming add-on's functionality as a network service makes it particularly attractive to attackers who can leverage the vulnerability to maintain long-term access. The vulnerability's exploitation timeline from initial access through command execution typically occurs within seconds, making it a preferred target for automated attack tools. Organizations using affected versions of the add-on face significant risk of unauthorized system access and potential data breaches.
The remediation for this vulnerability was addressed in Media Streaming add-on version 500.1.1.6 released on August 2, 2024, which implemented proper input sanitization and command execution validation. The fix likely included the implementation of strict input filtering mechanisms that prevent special characters from being interpreted as shell commands, along with proper escaping of user-supplied parameters before system execution. Organizations should immediately upgrade to the patched version and conduct thorough security assessments of their network infrastructure to identify any potential compromise indicators. System administrators should also review access controls and implement network segmentation to limit the attack surface, while monitoring for any unusual network activity that might indicate exploitation attempts. The vulnerability's resolution aligns with industry best practices for preventing command injection attacks as outlined in the OWASP Top Ten and NIST Cybersecurity Framework guidelines.