CVE-2017-15304

Name of the Vulnerable Software and Affected Versions Airtame HDMI dongle versions prior to 3.0

Description The issue allows an attacker to set their own session ID via a "Cookie: PHPSESSID=" header in the /bin/login.php file of the Web Panel. This can be used to achieve persistent access to the admin panel even after an admin password change.

Recommendations For versions prior to 3.0, update the firmware to version 3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the /bin/login.php file to minimize the risk of exploitation. Avoid using the PHPSESSID variable in the Cookie header until the issue is resolved.