Authentication flaw

2019-01-1818:29:00

PRIOn knowledge base

www.prio-n.com

9.3 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

67.9%

JSON

Crestron AM-100 before firmware version 1.6.0.2 contains an authentication bypass in the web interface’s return.cgi script. Unauthenticated remote users can use the bypass to access some administrator functionality such as configuring update sources and rebooting the device.

CPENameOperatorVersion
airmedia_am-100_firmwarelt1.6.0.2

CPE	Name	Operator	Version
	airmedia_am-100_firmware	lt	1.6.0.2

References

www.tenable.com/security/research/tra-2019-02