CVE-2019-3910

Crestron AM-100 before firmware version 1.6.0.2 contains an authentication bypass in the web interface's return.cgi script. Unauthenticated remote users can use the bypass to access some administrator functionality such as configuring update sources and rebooting the device.

CVSS v3.0

9.1 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

CVSS v2.0

8.5 HIGHAV:N/AC:L/Au:N/C:N/I:P/A:C

EPSS

8.56% chance of exploitation in the next 30 days, 95th percentile

Published

2019-01-18

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://www.tenable.com/security/research/tra-2019-02

References

• CVE Record
• NVD entry

Related

• CVE-2019-3844
• CVE-2019-3911
• CVE-2019-3843
• CVE-2019-3912
• CVE-2019-3842
• CVE-2019-3913