CVE-2018-13858

Name of the Vulnerable Software and Affected Versions MusicCenter / Trivum Multiroom Setup Tool version 8.76

Description The issue allows unauthorized remote attackers to reboot or execute other functions. This can be achieved via the "/xml/system/control.xml" API endpoint, using the GET request with the action variable set to reboot, for example, "?action=reboot".

Recommendations For MusicCenter / Trivum Multiroom Setup Tool version 8.76, as a temporary workaround, consider restricting access to the "/xml/system/control.xml" API endpoint to minimize the risk of exploitation. Avoid using the action variable in the affected API endpoint until the issue is resolved.