CVE-2016-5668
CriticalSummary
Crestron Electronics DM-TXRX-100-STR devices with firmware before version 1.3039.00040 allow remote attackers to bypass authentication and change settings via a JSON API call.
Risk Assessment
Attackers can remotely modify device settings, potentially leading to serious security breaches within the organization.
Recommendation
It is recommended to update the firmware to version 1.3039.00040 or later to secure the devices against these attacks.
Other vulnerabilities in Crestron Electronics DM-TXRX-100-STR
See all- CVE-2016-5670Critical
Crestron Electronics DM-TXRX-100-STR devices with firmware before version 1.3039.00040 have a hardcoded password 'admin' for the admin account, making it easier for remote attackers to gain access via the web management interface.
- CVE-2016-5669Critical
Crestron Electronics DM-TXRX-100-STR devices with firmware before version 1.3039.00040 use a hardcoded X.509 certificate from OpenSSL Test Certification Authority. This makes it easier for remote attackers to conduct man-in-the-middle attacks against HTTPS sessions.
- CVE-2016-5667Critical
Crestron Electronics DM-TXRX-100-STR devices with firmware before version 1.3039.00040 allow remote attackers to bypass authentication via a direct request to a page other than index.html.
Original NVD description (English source)
Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 allow remote attackers to bypass authentication and change settings via a JSON API call.