Lucene search

[email protected]CVE-2019-3928

HistoryApr 30, 2019 - 9:29 p.m.

CVE-2019-3928

2019-04-3021:29:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

crestron

am-100

am-101

firmware

vulnerability

presentation passcode

remote attack

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

6.8 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

52.7%

JSON

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allow any user to obtain the presentation passcode via the iso.3.6.1.4.1.3212.100.3.2.7.4 OIDs. A remote, unauthenticated attacker can use this vulnerability to access a restricted presentation or to become the presenter.

CPENameOperatorVersion
crestron:am-100_firmwarecrestron am-100 firmwareeq1.6.0.2
crestron:am-101_firmwarecrestron am-101 firmwareeq2.7.0.2

CPE	Name	Operator	Version
crestron:am-100_firmware	crestron am-100 firmware	eq	1.6.0.2
crestron:am-101_firmware	crestron am-101 firmware	eq	2.7.0.2

References

www.tenable.com/security/research/tra-2019-20

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

6.8 Medium

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

52.7%

JSON

Related for CVE-2019-3928

cvelist1 prion1 threatpost1