CVE-2022-23178

Critical

An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is…

mitre·CWE-287·Published 2022-01-15

CVSS

9.8

EPSS

0.76

KEV

Exploits

cve.orgen

318 chars

An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthenticated, user credentials are disclosed that are valid to authenticate to the web interface. Specifically, aj.html sends a JSON document with uname and upassword fields.

NVDen

318 chars

NVDes

338 chars

Se ha detectado un problema en los dispositivos Crestron HD-MD4X2-4K-E versión 1.0.0.2159. Cuando es accedida la interfaz web administrativa del conmutador HDMI sin autenticación, se revelan credenciales de usuario válidas para autenticarse en la interfaz web. En concreto, aj.html envía un documento JSON con los campos uname y upassword

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	10.0	10.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C
3.1	Primary	NVD	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2022-23178

CVSS metrics across sources