CVE-2016-5667
CriticalSummary
Crestron Electronics DM-TXRX-100-STR devices with firmware before version 1.3039.00040 allow remote attackers to bypass authentication via a direct request to a page other than index.html.
Risk Assessment
Attackers can gain access to sensitive device functions without authorization, potentially leading to unauthorized management of the device.
Recommendation
It is recommended to update the firmware to version 1.3039.00040 or later to secure the devices against this vulnerability.
Other vulnerabilities in Crestron Electronics DM-TXRX-100-STR
See all- CVE-2016-5670Critical
Crestron Electronics DM-TXRX-100-STR devices with firmware before version 1.3039.00040 have a hardcoded password 'admin' for the admin account, making it easier for remote attackers to gain access via the web management interface.
- CVE-2016-5669Critical
Crestron Electronics DM-TXRX-100-STR devices with firmware before version 1.3039.00040 use a hardcoded X.509 certificate from OpenSSL Test Certification Authority. This makes it easier for remote attackers to conduct man-in-the-middle attacks against HTTPS sessions.
- CVE-2016-5668Critical
Crestron Electronics DM-TXRX-100-STR devices with firmware before version 1.3039.00040 allow remote attackers to bypass authentication and change settings via a JSON API call.
Original NVD description (English source)
Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 allow remote attackers to bypass authentication via a direct request to a page other than index.html.