CVE-2017-15304

Critical

Published: 15/10/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In the web panel of the Airtame HDMI dongle with firmware before version 3.0, an attacker can set their own session ID via a 'Cookie: PHPSESSID=' header. This can lead to persistent access to the admin panel even after an admin password change.

Risk Assessment

The organization is at risk of unauthorized access to the admin panel, which could lead to serious security breaches and loss of control over the device.

Recommendation

It is recommended to update the device firmware to version 3.0 or later to mitigate this vulnerability.

Original NVD description (English source)

/bin/login.php in the Web Panel on the Airtame HDMI dongle with firmware before 3.0 allows an attacker to set his own session id via a "Cookie: PHPSESSID=" header. This can be used to achieve persistent access to the admin panel even after an admin password change.