CVE-2016-5670

CVE-2016-5670 affects Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040, which use non-random default credentials (admin:admin) for the web management interface. This hard-coded credential baseline enables remote attackers to gain privileged, unauthenticated access vi...

CVE-2016-5667

CVE-2016-5667 affects Crestron DM-TXRX-100-STR devices with firmware prior to 1.3039.00040. The vulnerability allows an unauthenticated remote attacker to bypass authentication by directly requesting a page other than index.html, effectively enabling access to the web management interface without...

CVE-2016-5671

The CVE-2016-5671 issue affects Crestron DM-TXRX-100-STR devices running firmware up to 1.3039.00040. The NVD entry describes multiple CSRF vulnerabilities in the device’s web interface that can allow remote attackers to hijack user authentication. Crestron’s vendor statement notes that CSRF (CVE...

CVE-2016-5666

CVE-2016-5666 affects Crestron DM-TXRX-100-STR, firmware versions older than 1.3039.00040. The vulnerability stems from client-side authentication in the web management interface, where an attacker can set objresp.authenabled to 1 and obtain administrative access remotely. The issue is part of mu...

CVE-2016-5640

Directory traversal vulnerability in cgi-bin/rftest.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to execute arbitrary commands via a .. dot dot in the ATECOMMAND parameter...

CVE-2016-5667

Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 allow remote attackers to bypass authentication via a direct request to a page other than index.html...

CVE-2016-5671

Multiple cross-site request forgery CSRF vulnerabilities on Crestron Electronics DM-TXRX-100-STR devices with firmware through 1.3039.00040 allow remote attackers to hijack the authentication of arbitrary users...

CVE-2016-5666

Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 rely on the client to perform authentication, which allows remote attackers to obtain access by setting the value of objresp.authenabled to 1...

CVE-2016-5669

The affected product is Crestron DM-TXRX-100-STR devices with firmware before 1.3039.00040. The root cause is a hardcoded X.509 certificate (0xb9eed4d955a59eb3 from the OpenSSL Test Certification Authority) used for HTTPS, which enables an attacker to perform MITM by exploiting the device’s trust...

CVE-2016-5639

CVE-2016-5639 affects Crestron AirMedia AM-100 devices with firmware versions prior to 1.4.0.13. A directory traversal vulnerability exists in cgi-bin/login.cgi where the src parameter can be crafted to read arbitrary files on the device, enabling unauthenticated remote access to sensitive data. ...

CVE-2016-5667: Undefined Security Weakness

Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 allow remote attackers to bypass authentication via a direct request to a page other than index.html...

CVE-2016-5669: Undefined Security Weakness

Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 use a hardcoded 0xb9eed4d955a59eb3 X.509 certificate from an OpenSSL Test Certification Authority, which makes it easier for remote attackers to conduct man-in-the-middle attacks against HTTPS sessions by leveraging th...

Crestron Electronics DM-TXRX-100-STR Man-in-the-Middle Attack Vulnerability

The Crestron Electronics DM-TXRX-100-STR is a multimedia streaming codec. The Crestron Electronics DM-TXRX-100-STR 1.3039.00040 uses a hard-coded X.509 certificate from the OpenSSL Test Certification Authority. This allows a man-in-the-middle attacker to spoof a server and obtain sensitive...

Crestron Electronics DM-TXRX-100-STR Hardcoded Password Vulnerability

The Crestron Electronics DM-TXRX-100-STR is a multimedia streaming codec. The Crestron Electronics DM-TXRX-100-STR 1.3039.00040 has a hard-coded password for the admin account. This could allow a remote attacker to gain access through the web management interface...

Crestron Electronics DM-TXRX-100-STR Security Restriction Bypass Vulnerability (CNVD-2016-05941)

The Crestron Electronics DM-TXRX-100-STR is a multimedia streaming codec. The Crestron Electronics DM-TXRX-100-STR 1.3039.00040 performs authentication via the client, which allows a remote attacker to set objresp.authenabled to 1 and gain access...

CVE-2016-5668: Undefined Security Weakness

Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 allow remote attackers to bypass authentication and change settings via a JSON API call...

Crestron Electronics DM-TXRX-100-STR Security Restriction Bypass Vulnerability (CNVD-2016-05940)

The Crestron Electronics DM-TXRX-100-STR is a multimedia streaming codec. A security vulnerability exists in the Crestron Electronics DM-TXRX-100-STR 1.3039.00040. It could allow a remote attacker to bypass authentication and change settings via JSON API calls...

Crestron Electronics DM-TXRX-100-STR Security Restriction Bypass Vulnerability

The Crestron Electronics DM-TXRX-100-STR is a multimedia streaming codec. A security vulnerability exists in the Crestron Electronics DM-TXRX-100-STR 1.3039.00040. It could allow a remote attacker to bypass authentication by directly requesting a non-index.html page...

Multiple Cross-Site Request Forgery Vulnerabilities in Crestron Electronics DM-TXRX-100-STR

The Crestron Electronics DM-TXRX-100-STR is a multimedia streaming codec. Multiple cross-site request forgery vulnerabilities exist in the Crestron Electronics DM-TXRX-100-STR 1.3039.00040. This could allow a remote attacker to hijack the authentication of arbitrary users...

CVE-2016-5640: Improper Neutralization of Special Elements used in a Command

Directory traversal vulnerability in cgi-bin/rftest.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to execute arbitrary commands via a .. dot dot in the ATECOMMAND parameter...