CVE-2019-3910

Crestron AM-100 before firmware version 1.6.0.2 contains an authentication bypass in the web interface's return.cgi script. Unauthenticated remote users can use the bypass to access some administrator functionality such as configuring update sources and rebooting the device.

CVSS v3 9.1 CRITICAL
CVSS v2.0 8.5 HIGH

9.1^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

8.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:C

Exploitability : 10.0 / Impact : 7.8

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact COMPLETE

References

Link	Resource
https://www.tenable.com/security/research/tra-2019-02	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:crestron:airmedia_am-100_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:crestron:airmedia_am-100:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-01-18 18:29

Updated : 2024-02-28 16:48

NVD link : CVE-2019-3910

Mitre link : CVE-2019-3910

CVE.ORG link : CVE-2019-3910

JSON object : View

Products Affected

crestron

airmedia_am-100
airmedia_am-100_firmware

CWE

NVD-CWE-noinfo

{"id": "CVE-2019-3910", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 8.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:C", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 7.8, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2019-01-18T18:29:00.417", "references": [{"url": "https://www.tenable.com/security/research/tra-2019-02", "tags": ["Exploit", "Third Party Advisory"], "source": "vulnreport@tenable.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Crestron AM-100 before firmware version 1.6.0.2 contains an authentication bypass in the web interface's return.cgi script. Unauthenticated remote users can use the bypass to access some administrator functionality such as configuring update sources and rebooting the device."}, {"lang": "es", "value": "Crestron AM-100, en versiones de firmware anteriores a la 1.6.0.2, contiene una omisi\u00f3n de autenticaci\u00f3n en el script \"return.cgi\" de la interfaz web. Usuarios remotos no autenticados pueden hacer uso de la omisi\u00f3n para acceder a algunas funcionalidades del administrador, como pueden ser la configuraci\u00f3n de la actualizaci\u00f3n de fuentes y el reinicio del dispositivo."}], "lastModified": "2020-08-24T17:37:01.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:crestron:airmedia_am-100_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "594D9A9A-A64D-40E3-B9BF-5D1765623CB2", "versionEndExcluding": "1.6.0.2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:crestron:airmedia_am-100:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "CA211175-30DE-466A-BEE9-8BD9EF2A25DE"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "vulnreport@tenable.com"}