CVE-2016-5669

Critical

Published: 03/08/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

Crestron Electronics DM-TXRX-100-STR devices with firmware before version 1.3039.00040 use a hardcoded X.509 certificate from OpenSSL Test Certification Authority. This makes it easier for remote attackers to conduct man-in-the-middle attacks against HTTPS sessions.

Risk Assessment

The organization is vulnerable to man-in-the-middle attacks, which could lead to the interception of sensitive data transmitted over HTTPS.

Recommendation

It is recommended to update the firmware to version 1.3039.00040 or later to eliminate the vulnerability associated with the hardcoded certificate.

Original NVD description (English source)

Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 use a hardcoded 0xb9eed4d955a59eb3 X.509 certificate from an OpenSSL Test Certification Authority, which makes it easier for remote attackers to conduct man-in-the-middle attacks against HTTPS sessions by leveraging the certificate's trust relationship.