PT-2017-14452 · Logitech · Logitech Media Server

Dewank Pant · Publicado 2017-11-09 · Atualizado 2025-02-04 · CVE-2017-16568

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Logitech Media Server version 7.9.0

Description The issue allows remote attackers to inject arbitrary web script or HTML via a radio URL, leading to persistent cross-site scripting (XSS) attacks. This enables attackers to inject malicious JavaScript payloads that become permanently stored on the server and execute when a user plays the compromised radio stream. Exploitation can result in session hijacking, unauthorized access, persistent manipulation of web content, and phishing or malicious redirects to external domains. The vulnerability can manipulate media server behavior in enterprise and home network environments.

Recommendations For Logitech Media Server version 7.9.0, consider disabling the "Radio" functionality as a temporary workaround until a patch is available. Restrict access to the radio URL to minimize the risk of exploitation. Avoid using the radio URL in the application until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-16568

Produtos afetados

Logitech Media Server

Referências · 4

• 🔥 https://exploit-db.com/exploits/43123 · Exploit
• https://t.me/cvenotify/109901 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2017-16568 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-16568 · Aviso do Fabricante