420 matches found
Open redirect
For Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001, The devices are shipped with authentication disabled, and there is no indication to users that they need to take steps to enable it. When compromised, the access to the CTP console is left open...
CVE-2018-10630
For Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001, The devices are shipped with authentication disabled, and there is no indication to users that they need to take steps to enable it. When compromised, the access to the CTP console is left open...
Code injection
Crestron TSW-X60 all versions prior to 2.001.0037.001 and MC3 all versions prior to 1.502.0047.00, The passwords for special sudo accounts may be calculated using information accessible to those with regular user privileges. Attackers could decipher these passwords, which may allow them to execut...
CVE-2018-13341
Crestron TSW-X60 all versions prior to 2.001.0037.001 and MC3 all versions prior to 1.502.0047.00, The passwords for special sudo accounts may be calculated using information accessible to those with regular user privileges. Attackers could decipher these passwords, which may allow them to execut...
CVE-2018-13341
CVE-2018-13341 affects Crestron TSW-X60 (pre-2.001.0037.001) and MC3 (pre-1.502.0047.001). Root cause: insufficiently protected credentials allowing password derivation for special sudo accounts from information accessible to regular users, enabling hidden API calls and escape from the CTP consol...
CVE-2018-10630
For Crestron TSW-X60 version prior to 2.001.0037.001 and MC3 version prior to 1.502.0047.001, The devices are shipped with authentication disabled, and there is no indication to users that they need to take steps to enable it. When compromised, the access to the CTP console is left open...
CVE-2018-10630
CVE-2018-10630 covers improper access control in Crestron TSW-X60 (versions before 2.001.0037.001) and MC3 (before 1.502.0047.001). The devices are shipped with authentication disabled, with no user indication to enable it; if compromised, access to the CTP console can be left open. Connected adv...
CVE-2018-13341
Crestron TSW-X60 all versions prior to 2.001.0037.001 and MC3 all versions prior to 1.502.0047.00, The passwords for special sudo accounts may be calculated using information accessible to those with regular user privileges. Attackers could decipher these passwords, which may allow them to execut...
Crestron TSW-X60 and MC3
1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Crestron Equipment: TSW-X60 and MC3 Vulnerabilities: OS Command Injections, Improper Access Control, Insufficiently Protected Credentials 2. RISK EVALUATION Successful exploitation of these...
Crestron AirMedia AM-100 and AM-101 Arbitrary Code Execution Vulnerabilities
The Crestron AirMedia AM-100 and AM-101 are both gateway products from Crestron Electronics USA. A security vulnerability exists in the Crestron Airmedia AM-100 using firmware versions prior to 1.6.0 and the AM-101 using firmware versions prior to 2.7.0. A remote attacker could exploit the...
CVE-2017-16709
Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote authenticated administrators to execute arbitrary code via unspecified vectors...
CVE-2017-16710
Cross-site scripting XSS vulnerability in Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2017-16710
Cross-site scripting XSS vulnerability in Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
Code injection
Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote authenticated administrators to execute arbitrary code via unspecified vectors...
Cross site scripting
Cross-site scripting XSS vulnerability in Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2017-16709
Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote authenticated administrators to execute arbitrary code via unspecified vectors...
CVE-2017-16709
CVE-2017-16709 affects Crestron AirMedia AM-100 (firmware < 1.6.0) and AM-101 (firmware
CVE-2017-16710
Cross-site scripting XSS vulnerability in Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2017-16709
Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote authenticated administrators to execute arbitrary code via unspecified vectors...
CVE-2017-16710
The CVE-2017-16710 issue affects Crestron AirMedia AM-100 and AM-101 devices. Affected products: AM-100 firmware versions prior to 1.6.0 and AM-101 firmware versions prior to 2.7.0. Description specifies a cross-site scripting (XSS) vulnerability that enables a remote attacker to inject arbitrary...