CVE-2019-3933

Name of the Vulnerable Software and Affected Versions Crestron AM-100 version 1.6.0.2 Crestron AM-101 version 2.7.0.2

Description The issue allows a remote, unauthenticated attacker to bypass the presentation code by requesting the "/images/browserslide.jpg" API endpoint via HTTP. This enables the attacker to watch a slideshow without knowing the access code.

Recommendations For Crestron AM-100 version 1.6.0.2, consider restricting access to the "/images/browserslide.jpg" endpoint until a patch is available. For Crestron AM-101 version 2.7.0.2, consider restricting access to the "/images/browserslide.jpg" endpoint until a patch is available.