Crestron AirMedia AM-100 contains multiple vulnerabilities

Overview

The Crestron AirMedia AM-100 with firmware prior to version 1.4.0.13 is vulnerable to path traversal and command injection.

Description

CWE-22**: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) -**CVE-2016-5639

A path traversal vulnerability exists in login.cgi (and possibly other binaries in the /home/boa/cgi-bin directory) on the AM-100 embedded web server. The src GET parameter passed to login.cgi specifies the relative path to a file for rendering, such as AwLoginDownload.html. However, the value of this parameter can specify an arbitrary path on the AM-100 filesystem.

CWE-77**: Improper Neutralization of Special Elements used in a Command (‘Command Injection’) -**CVE-2016-5640

A command injection vulnerability exists in rftest.cgi on the AM-100 embedded web server. The ATE_COMMAND POST parameter specifies the path to a command for the underlying OS to execute. By default, the value of this parameter is /sbin/iwpriv; however, the value of this parameter can be a relative or absolute path to any arbitrary command on the underlying OS.

Crestron AirMedia AM-100 firmware v1.1.1.11 - v1.2.1 are confirmed affected by the researcher. For more information see the researcher’s advisory one and advisory two.

---

Impact

An unauthenticated remote user may be able to access arbitrary files from the device filesystem, or execute arbitrary OS commands on the device.

---

Solution

Apply an update

Crestron has released firmware version 1.4.0.13 to address these issues. Affected users should update the firmware of their AM-100 as soon as possible.

---

Vendor Information

603047

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Crestron Electronics Affected

Updated: July 19, 2016

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

CVSS Metrics

Group	Score	Vector
Base	10	AV:N/AC:L/Au:N/C:C/I:C/A:C
Temporal	8.3	E:F/RL:OF/RC:C
Environmental	6.2	CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

• <http://www.crestron.com/products/model/AM-100&gt;
• <https://github.com/CylanceVulnResearch/disclosures/blob/master/CLVA-2016-05-001.md&gt;
• <https://github.com/CylanceVulnResearch/disclosures/blob/master/CLVA-2016-05-002.md&gt;
• <http://cwe.mitre.org/data/definitions/22.html&gt;
• <http://cwe.mitre.org/data/definitions/77.html&gt;

Acknowledgements

Thanks to Zach Lanier of Cylance, Inc., for reporting this vulnerability.

This document was written by Garret Wassermann.

Other Information

CVE IDs:	CVE-2016-5639, CVE-2016-5640
Date Public:	2016-08-01 Date First Published: