An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthenticated, user credentials are disclosed that are valid to authenticate to the web interface. Specifically, aj.html sends a JSON document with uname and upassword fields.
References
| Link | Resource |
|---|---|
| https://www.redteam-pentesting.de/advisories/rt-sa-2021-009 | Exploit Third Party Advisory |
| https://www.redteam-pentesting.de/advisories/rt-sa-2021-009 | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 06:48
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.redteam-pentesting.de/advisories/rt-sa-2021-009 - Exploit, Third Party Advisory |
28 Mar 2023, 16:38
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:h:creston:hd-md4x2-4k-e:-:*:*:*:*:*:*:* |
cpe:2.3:o:crestron:hd-md4x2-4k-e_firmware:1.0.0.2159:*:*:*:*:*:*:* cpe:2.3:h:crestron:hd-md4x2-4k-e:-:*:*:*:*:*:*:* |
24 Jan 2022, 19:57
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:h:creston:hd-md4x2-4k-e:-:*:*:*:*:*:*:* cpe:2.3:o:creston:hd-md4x2-4k-e_firmware:1.0.0.2159:*:*:*:*:*:*:* |
|
| CWE | CWE-287 | |
| References | (MISC) https://www.redteam-pentesting.de/advisories/rt-sa-2021-009 - Exploit, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : 10.0
v3 : 9.8 |
15 Jan 2022, 15:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-01-15 15:17
Updated : 2024-11-21 06:48
NVD link : CVE-2022-23178
Mitre link : CVE-2022-23178
CVE.ORG link : CVE-2022-23178
JSON object : View
Products Affected
crestron
- hd-md4x2-4k-e_firmware
- hd-md4x2-4k-e
CWE
CWE-287
Improper Authentication