CVE-2016-5671

The CVE-2016-5671 issue affects Crestron DM-TXRX-100-STR devices running firmware up to 1.3039.00040. The NVD entry describes multiple CSRF vulnerabilities in the device’s web interface that can allow remote attackers to hijack user authentication. Crestron’s vendor statement notes that CSRF (CVE...

CVE-2016-5666

Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 rely on the client to perform authentication, which allows remote attackers to obtain access by setting the value of objresp.authenabled to 1...

CVE-2016-5668

CVE-2016-5668 affects Crestron DM-TXRX-100-STR devices running firmware before 1.3039.00040. The vulnerability is an authentication bypass in the device’s web management interface, where a JSON API call can modify device settings without authentication (Missing Authentication for Critical Functio...

Crestron Electronics DM-TXRX-100-STR Security Restriction Bypass Vulnerability (CNVD-2016-05940)

The Crestron Electronics DM-TXRX-100-STR is a multimedia streaming codec. A security vulnerability exists in the Crestron Electronics DM-TXRX-100-STR 1.3039.00040. It could allow a remote attacker to bypass authentication and change settings via JSON API calls...

CVE-2016-5670: Undefined Security Weakness

Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 have a hardcoded password of admin for the admin account, which makes it easier for remote attackers to obtain access via the web management interface...

CVE-2016-5667: Undefined Security Weakness

Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 allow remote attackers to bypass authentication via a direct request to a page other than index.html...

CVE-2016-5668: Undefined Security Weakness

Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 allow remote attackers to bypass authentication and change settings via a JSON API call...

CVE-2016-5669: Undefined Security Weakness

Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 use a hardcoded 0xb9eed4d955a59eb3 X.509 certificate from an OpenSSL Test Certification Authority, which makes it easier for remote attackers to conduct man-in-the-middle attacks against HTTPS sessions by leveraging th...

CVE-2016-5666: Undefined Security Weakness

Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 rely on the client to perform authentication, which allows remote attackers to obtain access by setting the value of objresp.authenabled to 1...

PT-2016-6628

Name of the Vulnerable Software and Affected Versions Crestron Electronics DM-TXRX-100-STR devices with firmware through 1.3039.00040 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow remote attackers to hijack the authentication ...

PT-2016-6624

Name of the Vulnerable Software and Affected Versions Crestron Electronics DM-TXRX-100-STR devices with firmware prior to 1.3039.00040 Description The issue allows remote attackers to bypass authentication by making a direct request to a page other than index.html. Recommendations For Crestron...

PT-2016-6623

Name of the Vulnerable Software and Affected Versions Crestron Electronics DM-TXRX-100-STR devices with firmware prior to 1.3039.00040 Description The issue allows remote attackers to obtain access by setting the value of objresp.authenabled to 1, due to the device relying on the client to perfor...

PT-2016-6627

Name of the Vulnerable Software and Affected Versions Crestron Electronics DM-TXRX-100-STR devices with firmware prior to 1.3039.00040 Description The issue allows remote attackers to obtain access via the web management interface due to a hardcoded password of admin for the admin account...

CVE-2016-5671: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities on Crestron Electronics DM-TXRX-100-STR devices with firmware through 1.3039.00040 allow remote attackers to hijack the authentication of arbitrary users...

Crestron Electronics DM-TXRX-100-STR web interface contains multiple vulnerabilities

Overview Crestron Electronics DM-TXRX-100-STR, version 1.2866.00026 and earlier, has a web management interface which contains multiple vulnerabilities, including authentication bypass, failure to restrict access to authorized users, use of hard-coded certificate, default credentials, and...

Multiple Generic Vulnerabilities in the Special Equipment Inspection Management System of Tronda Electronics Co.

Tronda Electronics Co., Ltd. is a business dealing in camera accessories. A file read and SQL injection vulnerability exists in the Special Equipment Inspection Management System of Tronda Electronics Ltd. Allows attackers to utilize common SQL injection tools to obtain sensitive database...

SQL Injection Vulnerability in Special Equipment Inspection Management System of Fuzhou Tranda Electronics Co.(CNVD-2016-06025)

Fuzhou Chuangda Electronics Co., Ltd. is a high-tech enterprise specializing in software development, system integration, security services and other computer information services. Fuzhou Chuangda Electronics Co., Ltd. special equipment inspection management system/jy/util/selectryone.jsp?ryqx=1...

SQL Injection Vulnerability in Special Equipment Inspection Management System of Fuzhou Tranda Electronics Co.(CNVD-2016-06026)

Special Equipment Inspection Management System of Fuzhou Chuangda Electronics Co., Ltd. is a data and information management system. Fuzhou Chuangda Electronics Co., Ltd. special equipment inspection management system jy/bglskAction.do?task=edit&YWLSH=000038 page there is a SQL injection...

SQL Injection Vulnerability in Special Equipment Inspection Management System of Fuzhou Tranda Electronics Co.

Special Equipment Inspection Management System of Fuzhou Chuangda Electronics Co., Ltd. is a data and information management system. Fuzhou Chuangda Electronics Co., Ltd. special equipment inspection and management system: /jy/util/areaadmin.jsp?supform=froms&supaid=area&supcd=DQDM&supnm=area&csh...

SQL Injection Vulnerability in Special Equipment Inspection Management System of Fuzhou Tranda Electronics Co.(CNVD-2016-06022)

Fuzhou Tranda Electronics Co., Ltd. is a high-tech enterprise specializing in software development, system integration, security services and other computer information services. Fuzhou Chuangda Electronics Co., Ltd. special equipment inspection management system is a data information management...