CVE-2019-3933: crestron am-100_firmware Improper Access Control

Vulnerability summary

CVE-2019-3933 is a medium (CVSS 5.3) Improper Access Control vulnerability in crestron am-100_firmware. EPSS estimates a 5.95% chance of exploitation in the next 30 days, higher than 93.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 30-04-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass the presentation code simply by requesting /images/browserslide.jpg via HTTP. A remote, unauthenticated attacker can use this vulnerability to watch a slideshow without knowing the access code.

• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
• CWE-425Direct Request ('Forced Browsing')The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.