CVE-2019-3928

CVE-2019-3928 affects Crestron AM-100 (firmware 1.6.0.2) and AM-101 (firmware 2.7.0.2): an unauthenticated remote attacker can obtain the presentation passcode via the OIDs iso.3.6.1.4.1.3212.100.3.2.7.4 and either access a restricted presentation or become the presenter. Connected sources confir...

CVE-2019-3927

CVE-2019-3927 concerns Crestron AM-100 (firmware 1.6.0.2) and AM-101 (firmware 2.7.0.2). The issue allows anyone to change the administrator or moderator passwords via the OIDs iso.3.6.1.4.1.3212.100.3.2.8.1 and iso.3.6.1.4.1.3212.100.3.2.8.2, enabling a remote, unauthenticated attacker to gain a...

CVE-2019-3926

Crestron AM-100 (firmware 1.6.0.2) and AM-101 (firmware 2.7.0.2) are affected by CVE-2019-3926 due to an unauthenticated SNMP command-injection flaw (OID iso.3.6.1.4.1.3212.100.3.2.14.1). The issue allows remote code execution as root. Public sources confirm this affects Crestron AirMedia devices...

CVE-2019-3926

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to command injection via SNMP OID iso.3.6.1.4.1.3212.100.3.2.14.1. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root...

CVE-2019-3925

CVE-2019-3925 affects Crestron AM-100 (firmware 1.6.0.2) and AM-101 (firmware 2.7.0.2). The vulnerability is a remote, unauthenticated command injection via SNMP with OID iso.3.6.1.4.1.3212.100.3.2.9.3, allowing an attacker to execute OS commands as root. Related Red Hat and CVE listings corrobor...

CVE-2019-3925

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to command injection via SNMP OID iso.3.6.1.4.1.3212.100.3.2.9.3. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root...

PT-2019-16786 · Crestron · Crestron Am-100 +1

Name of the Vulnerable Software and Affected Versions: Crestron AM-100 version 1.6.0.2 Crestron AM-101 version 2.7.0.2 Description: The issue is related to authentication bypass due to a hard-coded password in the return.tgi file. A remote, unauthenticated attacker can exploit this to control...

PT-2019-16792 · Crestron · Crestron Am-100 +2

Name of the Vulnerable Software and Affected Versions: Crestron AM-100 version 1.6.0.2 Crestron AM-101 version 2.7.0.2 Description: The issue allows a local attacker to gain access to a device's username and passwords. This is possible because the configuration file, which stores sensitive...

PT-2019-16782 · Crestron · Crestron Am-100 +1

Name of the Vulnerable Software and Affected Versions: Crestron AM-100 version 1.6.0.2 Crestron AM-101 version 2.7.0.2 Description: The issue allows any user to obtain the presentation passcode via specific OIDs, iso.3.6.1.4.1.3212.100.3.2.7.4. A remote, unauthenticated attacker can exploit this ...

Authentication flaw

Crestron AM-100 before firmware version 1.6.0.2 contains an authentication bypass in the web interface's return.cgi script. Unauthenticated remote users can use the bypass to access some administrator functionality such as configuring update sources and rebooting the device...

CVE-2019-3910

The CVE-2019-3910 issue affects Crestron AM-100 devices running firmware before 1.6.0.2. Affected component is the web interface’s return.cgi script, enabling an authentication bypass that allows unauthenticated remote access to administrator-level functions (e.g., configuring update sources and ...

Crestron AirMedia AM-100 and AM-101 Cross-Site Scripting Vulnerabilities

The Crestron AirMedia AM-100 and AM-101 are both gateway products from Crestron Electronics USA. A cross-site scripting vulnerability exists in the Crestron Airmedia AM-100 using firmware versions prior to 1.6.0 and the AM-101 using firmware versions prior to 2.7.0. A remote attacker can exploit...

CVE-2017-16710

Cross-site scripting XSS vulnerability in Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-16709

Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote authenticated administrators to execute arbitrary code via unspecified vectors...

CVE-2017-16709

CVE-2017-16709 affects Crestron AirMedia AM-100 (firmware < 1.6.0) and AM-101 (firmware

CVE-2017-16710

The CVE-2017-16710 issue affects Crestron AirMedia AM-100 and AM-101 devices. Affected products: AM-100 firmware versions prior to 1.6.0 and AM-101 firmware versions prior to 2.7.0. Description specifies a cross-site scripting (XSS) vulnerability that enables a remote attacker to inject arbitrary...

Crestron AM-100 - Multiple Vulnerabilities

================================================================= Crestron AM-100 Multiple Vulnerabilities ================================================================= Date: 2016-08-01 Exploit Author: Zach Lanier Vendor Homepage: https://www.crestron.com/products/model/am-100 Version:...

SSH Brute Force Logins With Default Credentials Reporting

It was possible to login into the remote SSH server using default credentials. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the microprogramming software of the presentation server Crestron AirMedia AM-100 allows a intruder to execute arbitrary commands.

The vulnerability of the bin/rftest.cgi file in the Crestron AirMedia AM-100 presentation server’s microprogramming software is related to deficiencies in pathname restriction. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands via the ATEcommand parameter...

Crestron AirMedia AM-100 cgi-bin/login.cgi Directory Traversal Vulnerability

The Crestron AirMedia AM-100 is a gateway product from Crestron Electronics, USA. A directory traversal vulnerability in the cgi-bin/login.cgi file in the Crestron AirMedia AM-100 device allows remote attackers to submit a special request to read arbitrary files...