PT-2016-6611 · Crestron · Crestron Airmedia Am-100

Benichmt1 + 1 · Publicado 2016-08-03 · Atualizado 2017-09-03 · CVE-2016-5639

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Crestron AirMedia AM-100 versions prior to 1.4.0.13

Description A directory traversal issue exists in the cgi-bin/login.cgi file, allowing remote attackers to read arbitrary files by including a .. (dot dot) in the src parameter of the affected API endpoint.

Recommendations For versions prior to 1.4.0.13, update the firmware to version 1.4.0.13 or later to resolve the issue. As a temporary workaround, consider restricting access to the cgi-bin/login.cgi file until the update is applied. Avoid using the src parameter in the vulnerable endpoint until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2016-5639

Produtos afetados

Crestron Airmedia Am-100

Referências · 6

• 🔥 https://exploit-db.com/exploits/40813 · Exploit
• https://github.com/CylanceVulnResearch/disclosures/blob/master/CLVA-2016-05-001.md · Nota
• http://securityfocus.com/bid/92216 · Nota
• https://osv.dev/vulnerability/CVE-2016-5639 · Aviso do Fabricante
• http://kb.cert.org/vuls/id/603047 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-5639 · Nota de Segurança