Janus Gateway
Monthly
Unauthenticated path traversal in Janus WebRTC Server through 1.4.3 allows attackers to write files outside the configured recordings path via the Record&Play plugin's record request filename when the plugin is loaded and its signaling API is reachable. Exploitation is limited: the attacker can only create or truncate files ending in -audio.mjr, -video.mjr, or -data.mjr where the Janus process has write permissions, yielding low integrity impact (CVSS 6.9). Publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) has been reported.
Hard-coded credentials in Meetecho Janus Gateway up to 1.4.2 can expose the Admin API through the bundled demo file html/demos/admin.js; the issue is remotely reachable and publicly available exploit code exists, but the independent assessment rates it low priority because exposure is limited to deployments that serve the demo content or leave the Admin API reachable. The CVSS 4.0 vector indicates low privileges (PR:L) with low confidentiality, integrity, and availability impact, and the provided references are VulDB entries rather than a confirmed vendor patch.
Authenticated participants of the Meetecho Janus Gateway VideoRoom plugin can bypass a room's max_publishers cap by winning a narrow timing race between a session's 'starting' and 'started' states, allowing more concurrent publishers in a room than the operator configured (CWE-362). The issue is a low-severity one: it requires an authenticated, low-privileged VideoRoom participant able to send 'publish' requests, only matters for rooms that actually enforce a publisher limit, and yields only Low integrity and Low availability impact with no confidentiality loss (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L; CVSS 4.0 base 2.3 with AC:H and E:P). Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV), and the vendor responded quickly with an upstream fix in PR #3678 (commit 27c0d1af888153e818675b56a4e6267f62d57097).
Unauthenticated path traversal in Janus WebRTC Server through 1.4.3 allows attackers to write files outside the configured recordings path via the Record&Play plugin's record request filename when the plugin is loaded and its signaling API is reachable. Exploitation is limited: the attacker can only create or truncate files ending in -audio.mjr, -video.mjr, or -data.mjr where the Janus process has write permissions, yielding low integrity impact (CVSS 6.9). Publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) has been reported.
Hard-coded credentials in Meetecho Janus Gateway up to 1.4.2 can expose the Admin API through the bundled demo file html/demos/admin.js; the issue is remotely reachable and publicly available exploit code exists, but the independent assessment rates it low priority because exposure is limited to deployments that serve the demo content or leave the Admin API reachable. The CVSS 4.0 vector indicates low privileges (PR:L) with low confidentiality, integrity, and availability impact, and the provided references are VulDB entries rather than a confirmed vendor patch.
Authenticated participants of the Meetecho Janus Gateway VideoRoom plugin can bypass a room's max_publishers cap by winning a narrow timing race between a session's 'starting' and 'started' states, allowing more concurrent publishers in a room than the operator configured (CWE-362). The issue is a low-severity one: it requires an authenticated, low-privileged VideoRoom participant able to send 'publish' requests, only matters for rooms that actually enforce a publisher limit, and yields only Low integrity and Low availability impact with no confidentiality loss (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L; CVSS 4.0 base 2.3 with AC:H and E:P). Publicly available exploit code exists, but there is no confirmed active exploitation (not in CISA KEV), and the vendor responded quickly with an upstream fix in PR #3678 (commit 27c0d1af888153e818675b56a4e6267f62d57097).