high7.5Public exploit code
CVE-2016-5639
Directory traversal vulnerability in cgi-bin/login.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to read arbitr…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Crestron AM-100 - Multiple Vulnerabilities2016-11-22 · remote · hardware · Verified
Impact
Directory traversal vulnerability in cgi-bin/login.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to read arbitrary files via a .. (dot dot) in the src parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Crestron | Airmedia Am-100 Firmware | through 1.4.0.12 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.kb.cert.org/vuls/id/603047
- http://www.securityfocus.com/bid/92216
- https://github.com/CylanceVulnResearch/disclosures/blob/master/CLVA-2016-05-001.md
- https://www.exploit-db.com/exploits/40813/
- http://www.kb.cert.org/vuls/id/603047
- http://www.securityfocus.com/bid/92216
- https://github.com/CylanceVulnResearch/disclosures/blob/master/CLVA-2016-05-001.md
- https://www.exploit-db.com/exploits/40813/