CVE-2019-3933: Medium severity crestron airmedia am-100 firmware vulnerability
Published Apr 30, 2019
·Updated
Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass the presentation code simply by requesting /images/browserslide.jpg via HTTP. A remote, unauthenticated attacker can use this vulnerability to watch a slideshow without knowing the access code.
Affected Software
8 affected components
Crestron AM-100 firmware=1.6.0.2
Crestron AM-100
Crestron AM-101 firmware=2.7.0.2
Crestron AM-101
All of the following
Crestron AM-100 firmware=1.6.0.2
Crestron AM-100
All of the following
Crestron AM-101 firmware=2.7.0.2
Crestron AM-101
Event History
Apr 30, 2019
CVE Published
via MITRE·08:30 PM
Data Sourced
via MITRE·08:30 PM
DescriptionWeakness
Data Sourced
via NVD·09:29 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2019-3933.
2
What is the severity of CVE-2019-3933?
The severity of CVE-2019-3933 is medium (5.3).
3
Which devices are affected by CVE-2019-3933?
Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are affected by CVE-2019-3933.
4
How can an attacker exploit CVE-2019-3933?
An attacker can exploit CVE-2019-3933 by requesting /images/browserslide.jpg via HTTP to bypass the presentation code and watch a slideshow without knowing the access code.
5
Is authentication required to exploit CVE-2019-3933?
No, authentication is not required to exploit CVE-2019-3933.