PT-2021-10075
CVE-2020-16839
·
Published
2021-07-27
·
Updated
2022-07-12
Description by
CVSS 3.1
7.5
HighMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions:
Crestron DM-NVX-DIR versions prior to DM-XIO/1-0-3-802 patch
Crestron DM-NVX-DIR80 versions prior to DM-XIO/1-0-3-802 patch
Crestron DM-NVX-ENT versions prior to DM-XIO/1-0-3-802 patch
Description:
The issue allows the password to be changed by sending an unauthenticated WebSocket request.
Recommendations:
For Crestron DM-NVX-DIR versions prior to DM-XIO/1-0-3-802 patch, apply the DM-XIO/1-0-3-802 patch to resolve the issue.
For Crestron DM-NVX-DIR80 versions prior to DM-XIO/1-0-3-802 patch, apply the DM-XIO/1-0-3-802 patch to resolve the issue.
For Crestron DM-NVX-ENT versions prior to DM-XIO/1-0-3-802 patch, apply the DM-XIO/1-0-3-802 patch to resolve the issue.
Found an issue in the description? Have something to add? Feel free to write us 👾