CVE-2016-5670
CriticalSummary
Crestron Electronics DM-TXRX-100-STR devices with firmware before version 1.3039.00040 have a hardcoded password 'admin' for the admin account, making it easier for remote attackers to gain access via the web management interface.
Risk Assessment
This vulnerability poses a risk of unauthorized access to the devices, potentially leading to serious security breaches within the organization.
Recommendation
It is recommended to update the firmware to version 1.3039.00040 or later to remove the hardcoded password and enhance the security of the devices.
Other vulnerabilities in Crestron Electronics DM-TXRX-100-STR
See all- CVE-2016-5669Critical
Crestron Electronics DM-TXRX-100-STR devices with firmware before version 1.3039.00040 use a hardcoded X.509 certificate from OpenSSL Test Certification Authority. This makes it easier for remote attackers to conduct man-in-the-middle attacks against HTTPS sessions.
- CVE-2016-5668Critical
Crestron Electronics DM-TXRX-100-STR devices with firmware before version 1.3039.00040 allow remote attackers to bypass authentication and change settings via a JSON API call.
- CVE-2016-5667Critical
Crestron Electronics DM-TXRX-100-STR devices with firmware before version 1.3039.00040 allow remote attackers to bypass authentication via a direct request to a page other than index.html.
Original NVD description (English source)
Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 have a hardcoded password of admin for the admin account, which makes it easier for remote attackers to obtain access via the web management interface.