CVE-2019-3934: crestron am-100_firmware Improper Access Control

Vulnerability summary

CVE-2019-3934 is a medium (CVSS 5.3) Improper Access Control vulnerability in crestron am-100_firmware. EPSS estimates a 7.73% chance of exploitation in the next 30 days, higher than 94.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 30-04-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass the presentation code sending a crafted HTTP POST request to login.cgi. A remote, unauthenticated attacker can use this vulnerability to download the current slide image without knowing the access code.

• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
• CWE-425Direct Request ('Forced Browsing')The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.