Local Privilege Escalation Vulnerability in Wowza Streaming Engine
CVE-2016-20033

8.5HIGH

Key Information:

Vendor: Wowza Media Systems, Llc.
Status: Wowza Streaming Engine
Vendor: CVE Published:; 15 March 2026

🔔 Create Wowza Media Systems, Llc. Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2016-20033?

Wowza Streaming Engine version 4.5.0 is susceptible to a local privilege escalation vulnerability that can be exploited by authenticated users. Due to poorly configured file permissions that allow unrestricted access for the Everyone group, it becomes feasible for attackers to manipulate critical executable files. Specifically, they can replace the nssm_x64.exe binary in both the manager and engine service directories with malicious code. As a result, when the affected services are restarted, this can lead to code being executed with elevated LocalSystem privileges, posing significant security risks.

Affected Version(s)

Wowza Streaming Engine 4.5.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2016-20033 - Proof of Concept