CVE-2019-3934

Vulnerability

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 contain a vulnerability in the login.cgi endpoint. By sending a crafted HTTP POST request, an unauthenticated remote attacker can bypass the presentation code check that normally restricts access to the current slide image. The affected devices are presentation systems that require a numeric access code to view or control slides; this flaw removes that requirement entirely [1].

Exploitation

An attacker needs only network access to the device; no authentication or prior knowledge of the presentation code is required. The exploit consists of sending a specially crafted HTTP POST request to the /login.cgi endpoint. The exact parameters are not publicly detailed, but the request triggers the bypass, allowing the attacker to retrieve the current slide image without supplying the correct access code [1].

Impact

Successful exploitation enables an unauthenticated attacker to download the current slide image being displayed on the presentation system. This results in unauthorized disclosure of potentially sensitive presentation content, violating the confidentiality of the presentation. The attacker does not gain administrative control or the ability to modify slides, but can view the current slide without the intended access restriction [1].

Mitigation

As of the publication date (2019-04-30), Crestron has not released a firmware update to address this vulnerability. Users should restrict network access to the device to trusted hosts only, place the device behind a firewall, and avoid exposing it to untrusted networks. If possible, disable the presentation code bypass feature or monitor for suspicious HTTP requests to login.cgi [1].