CVE-2024-0643 is a critical severity unrestricted file upload flaw in C21 Live Encoder, scored CVSS 10.0. The INCIBE notice lists C21 Live Encoder and Live Mosaic version 5.3. INCIBE says Cires21 resolved the issues in the latest software version released at the end of November 2023 but names no specific number.
What's affected
The INCIBE notice lists C21 Live Encoder and Live Mosaic version 5.3.
The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, with a base score of 10.0 (Critical). KEV status: not listed in the record.
Fixed version: INCIBE says Cires21 resolved the issues in the latest software version released at the end of November 2023 but names no specific number. Confirm the current version with the vendor.
How to check if you're exposed
Open the device or product admin interface and read the firmware or software version on the system or about page. Compare it with the version in the record, and with the vendor notice. If you cannot tell, ask the vendor or integrator for the exact build.
What to do now
- Inventory the affected devices and where they sit on the network.
- Apply the vendor fix or firmware named in the advisory, and confirm the version afterwards.
- Limit access to the management interface to a trusted network and require strong credentials.
- Record the device in your asset inventory with the CVE so the fix is tracked.
Why it matters
CWE-434 describes this class. Unrestricted upload of a dangerous file type means the application accepts a file without limiting its type or where it is stored. If an uploaded file can later be run by the server, the upload becomes a way to run code. Allow lists of extensions, content checks, and storing uploads outside the web root are the usual controls.
The record does not mark this CVE as exploited in the wild, and it is not in the CISA KEV catalog. Published 2024-01-17.
Safeguard Gold keeps a page for this CVE at gold.safeguard.sh, and the free in-browser dependency scan can show whether software you build bundles related components.
Quick check
Is CVE-2024-0643 exploited in the wild?
The record's KEV flag is false, and none of the pages I fetched said otherwise. That is not proof of safety, so still patch or restrict access.
Where do I get the fix?
From the vendor or integrator. The advisory linked in the sources is the place to start.
Sources
- INCIBE CERT notice on Cires21 products
- Safeguard Gold entry for CVE-2024-0643
- NVD record data for CVE-2024-0643.
Last reviewed: 19 October 2026.
