CVE-2024-0642 is a critical severity broken access control flaw in C21 Live Encoder, scored CVSS 9.8. The INCIBE notice lists C21 Live Encoder and Live Mosaic version 5.3. INCIBE says Cires21 resolved the issues in the latest software version released at the end of November 2023 but names no specific number.
What's affected
The INCIBE notice lists C21 Live Encoder and Live Mosaic version 5.3.
The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, with a base score of 9.8 (Critical). KEV status: not listed in the record.
Fixed version: INCIBE says Cires21 resolved the issues in the latest software version released at the end of November 2023 but names no specific number. Confirm the current version with the vendor.
How to check if you're exposed
Open the device or product admin interface and read the firmware or software version on the system or about page. Compare it with the version in the record, and with the vendor notice. If you cannot tell, ask the vendor or integrator for the exact build.
What to do now
- Inventory the affected devices and where they sit on the network.
- Apply the vendor fix or firmware named in the advisory, and confirm the version afterwards.
- Limit access to the management interface to a trusted network and require strong credentials.
- Record the device in your asset inventory with the CVE so the fix is tracked.
Why it matters
CWE-284 describes this class. Improper access control is a broad class. The system fails to restrict access to a resource or function to the parties who should have it. The record does not narrow the cause further, so the exact mechanism should be read from the vendor or coordinator advisory.
The record does not mark this CVE as exploited in the wild, and it is not in the CISA KEV catalog. Published 2024-01-17.
Safeguard Gold keeps a page for this CVE at gold.safeguard.sh, and the free in-browser dependency scan can show whether software you build bundles related components.
Quick check
Is CVE-2024-0642 exploited in the wild?
The record's KEV flag is false, and none of the pages I fetched said otherwise. That is not proof of safety, so still patch or restrict access.
Where do I get the fix?
From the vendor or integrator. The advisory linked in the sources is the place to start.
Sources
- INCIBE CERT notice on Cires21 products
- Safeguard Gold entry for CVE-2024-0642
- NVD record data for CVE-2024-0642.
Last reviewed: 19 October 2026.
