CVE-2022-23178

An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthenticated, user credentials are disclosed that are valid to authenticate to the web interface. Specifically, aj.html sends a JSON document with uname and upassword fields.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

75.16% chance of exploitation in the next 30 days, 99th percentile

Nuclei

critical · CWE-287

Published

2022-01-15

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://www.redteam-pentesting.de/advisories/rt-sa-2021-009

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-23178.yaml

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/50675

Exploit collections (1)

• zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2022/CVE-2022-23178.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2022-2317
• CVE-2022-23179
• CVE-2022-2314
• CVE-2022-23180
• CVE-2022-23134
• CVE-2022-2321