Drew Green

**Name of the Vulnerable Software and Affected Versions** Tightrope Media Carousel Seneca HDn version 7.0.4.104 **Description** The issue concerns a default local administrator username and password that can be discovered by a limited user account. This sensitive information is stored in an "unattend.xml" file on the C: drive, which is a leftover from the Sysprep process. An attacker who obtains this username and password can use it to gain administrator-level access to the system. **Recommendations** For version 7.0.4.104, change the default local administrator username and password to unique and secure credentials to prevent unauthorized access. Additionally, consider restricting access to the "unattend.xml" file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Tightrope Media Carousel digital signage product version 7.0.4.104 **Description** The issue allows an authenticated attacker to upload a crafted ZIP file containing a malicious file through the Manage Bulletins/Upload feature. This can lead to remote code execution. The system checks for the presence of needed files within the ZIP and extracts all contained files to a new directory, named with a random GUID. The attacker can determine this GUID by previewing an image from the uploaded Bulletin within the web UI and then navigate to the malicious file to execute it. In testing, an ASPX web shell was uploaded, allowing for remote-code execution in the context of a restricted IIS user. **Recommendations** For version 7.0.4.104, consider disabling the Manage Bulletins/Upload feature until a patch is available to prevent exploitation. Restrict access to the uploaded files and directories to minimize the risk of remote code execution. Avoid using the feature to upload ZIP files from untrusted sources. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tightrope Media Carousel digital signage product version 7.0.4.104 **Description** An issue in the Tightrope Media Carousel digital signage product allows an attacker with system access to elevate privileges from a restricted account to full SYSTEM by replacing the Carousel.Service.exe file with a malicious executable. The Carousel.Service.exe file is located in the C:TRMSServices directory, which has insecure default permissions. This service is independent of the associated IIS web site and can be manipulated without affecting access to vulnerabilities in the web interface. An attacker can replace Carousel.Service.exe and then restart the server using the command "shutdown -r -t 0" from a web shell, causing the system to reboot and launch the malicious Carousel.Service.exe as SYSTEM on startup. If the malicious executable is configured to launch a reverse shell, the attacker will have a fully privileged remote command-line environment upon reboot. **Recommendations** For version 7.0.4.104, consider restricting access to the C:TRMSServices directory to prevent replacement of the Carousel.Service.exe file until a patch is available. As a temporary workaround, monitor the system for any unauthorized restarts or changes to the Carousel.Service.exe file.