PT-2017-14451 · Logitech · Logitech Media Server

Dewank Pant · Published 2017-11-09 · Updated 2025-02-04 · CVE-2017-16567

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Logitech Media Server version 7.9.0

Description The issue is related to a Cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via a favorite. This vulnerability can lead to Session Hijacking and Credential Theft, Execution of unauthorized actions on behalf of users, and Exfiltration of sensitive data. It presents a potential risk for widespread exploitation in connected IoT environments.

Recommendations For Logitech Media Server version 7.9.0, consider disabling the Favorites feature until a patch is available to prevent the injection and permanent storage of malicious JavaScript payloads. Restrict access to the affected functionality to minimize the risk of exploitation. Avoid using the favorite feature in the affected version until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-16567

Affected Products

Logitech Media Server

References · 4

• 🔥 https://exploit-db.com/exploits/43122 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-16567 · Security Note
• https://osv.dev/vulnerability/CVE-2017-16567 · Vendor Advisory
• https://t.me/cvenotify/109900 · Telegram Post