PT-2019-16765 · Crestron · Crestron Am-100

Publicado 2019-01-18 · Atualizado 2020-08-24 · CVE-2019-3910

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Crestron AM-100 versions prior to 1.6.0.2

Description The issue concerns an authentication bypass in the web interface's return.cgi script, allowing unauthenticated remote users to access certain administrator functionality. This includes configuring update sources and rebooting the device.

Recommendations For versions prior to 1.6.0.2, update to firmware version 1.6.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2019-3910

Produtos afetados

Crestron Am-100

Referências · 3

• 🔥 https://tenable.com/security/research/tra-2019-02 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-3910 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-3910 · Aviso do Fabricante