Vulnerability identifier: #VU50790

Vulnerability risk: Medium

CVSSv3.1:

CVE-ID: CVE-2020-25605

CWE-ID: CWE-319

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Agora SDK
Server applications / Conferencing, Collaboration and VoIP solutions

Vendor:

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to software uses insecure communication channel to transmit sensitive information. A remote attacker with ability to intercept network traffic can obtain access to audio and video of any ongoing Agora video call.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

---

External links
http://docs.agora.io/en/Agora%20Platform/downloads
http://www.mcafee.com/blogs/other-blogs/mcafee-labs/dont-call-us-well-call-you-mcafee-atr-finds-vulnerability-in-agora-video-sdk/

---

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?