CVE-2017-16710

Published: Jul 11, 2018Modified: Nov 21, 2024

4.8

Vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Exploitability: 1.7 / Impact: 2.7

Source: NVD

Description

Cross-site scripting (XSS) vulnerability in Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected (2)

Products: Crestron: Airmedia Am 100 Firmware, Airmedia Am 101 Firmware

Crestron

2 products

Airmedia Am 100 Firmware

Airmedia Am 101 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Crestron Airmedia Am 100 Firmware	Before 1.6.0

Running on/with	Platform Versions
Crestron Airmedia Am 100	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Crestron Airmedia Am 101 Firmware	Before 2.7.0

Running on/with	Platform Versions
Crestron Airmedia Am 101	All versions

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://support.crestron.com/app/answers/answer_view/a_id/5471/~/the-latest-details-from-crestron-on-security-and-safety-on-the-internet#CVE-2017-16710

Source: cve@mitre.org

Vendor Advisory

https://support.crestron.com/app/answers/answer_view/a_id/5471/~/the-latest-details-from-crestron-on-security-and-safety-on-the-internet#CVE-2017-16710

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.