Details of VAR-201904-0331

ID

VAR-201904-0331

CVE

CVE-2019-3938

TITLE

Crestron AM-100 and AM-101 Vulnerabilities related to the use of hard-coded credentials in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2019-004044

DESCRIPTION

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 stores usernames, passwords, and other configuration options in the file generated via the "export configuration" feature. The configuration file is encrypted using the awenc binary. The same binary can be used to decrypt any configuration file since all the encryption logic is hard coded. A local attacker can use this vulnerability to gain access to devices username and passwords. Crestron AM-100 and AM-101 Firmware contains a vulnerability related to the use of hard-coded credentials.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Crestron Electronics AM-100 and Crestron Electronics AM-101 are both smart home gateway products of Crestron Electronics in the United States. A trust management issue vulnerability exists in Crestron AM-100 with firmware version 1.6.0.2 and AM-101 with firmware version 2.7.0.2. This vulnerability stems from the lack of an effective trust management mechanism in network systems or products. Attackers can use default passwords or hard-coded passwords, hard-coded certificates, etc. to attack affected components

Trust: 1.71

sources: NVD: CVE-2019-3938 // JVNDB: JVNDB-2019-004044 // VULHUB: VHN-155373

AFFECTED PRODUCTS

vendor:	crestron	model:	am-100	scope:	eq	version:	1.6.0.2	Trust: 1.0
vendor:	crestron	model:	am-101	scope:	eq	version:	2.7.0.2	Trust: 1.0
vendor:	crestron	model:	airmedia am-100	scope:	eq	version:	1.6.0.2	Trust: 0.8
vendor:	crestron	model:	airmedia am-101	scope:	eq	version:	2.7.0.2	Trust: 0.8

sources: JVNDB: JVNDB-2019-004044 // NVD: CVE-2019-3938

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-3938
value:	HIGH
Trust: 1.0
NVD:	CVE-2019-3938
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201904-1396
value:	HIGH
Trust: 0.6
VULHUB:	VHN-155373
value:	LOW
Trust: 0.1

nvd@nist.gov:	CVE-2019-3938
severity:	LOW
baseScore:	2.1
vectorString:	AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-155373
severity:	LOW
baseScore:	2.1
vectorString:	AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2019-3938
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2019-3938
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-155373 // JVNDB: JVNDB-2019-004044 // CNNVD: CNNVD-201904-1396 // NVD: CVE-2019-3938

PROBLEMTYPE DATA

problemtype:	CWE-798	Trust: 1.9
problemtype:	CWE-522	Trust: 1.0

sources: VULHUB: VHN-155373 // JVNDB: JVNDB-2019-004044 // NVD: CVE-2019-3938

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201904-1396

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-201904-1396

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-004044

PATCH

title:	AM-100	url:	https://www.crestron.com/en-US/Products/Workspace-Solutions/Wireless-Presentation-Solutions/AirMedia-Presentation-Gateways/AM-100	Trust: 0.8
title:	AM-101	url:	https://www.crestron.com/en-US/Products/Workspace-Solutions/Wireless-Presentation-Solutions/AirMedia-Presentation-Gateways/AM-101	Trust: 0.8

sources: JVNDB: JVNDB-2019-004044

EXTERNAL IDS

db:	NVD	id:	CVE-2019-3938	Trust: 2.5
db:	TENABLE	id:	TRA-2019-20	Trust: 2.5
db:	JVNDB	id:	JVNDB-2019-004044	Trust: 0.8
db:	CNNVD	id:	CNNVD-201904-1396	Trust: 0.7
db:	VULHUB	id:	VHN-155373	Trust: 0.1

sources: VULHUB: VHN-155373 // JVNDB: JVNDB-2019-004044 // CNNVD: CNNVD-201904-1396 // NVD: CVE-2019-3938

REFERENCES

url:	https://www.tenable.com/security/research/tra-2019-20	Trust: 2.5
url:	https://nvd.nist.gov/vuln/detail/cve-2019-3938	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-3938	Trust: 0.8

sources: VULHUB: VHN-155373 // JVNDB: JVNDB-2019-004044 // CNNVD: CNNVD-201904-1396 // NVD: CVE-2019-3938

SOURCES

db:	VULHUB	id:	VHN-155373
db:	JVNDB	id:	JVNDB-2019-004044
db:	CNNVD	id:	CNNVD-201904-1396
db:	NVD	id:	CVE-2019-3938

LAST UPDATE DATE

2024-11-23T21:37:29.077000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-155373	date:	2022-12-06T00:00:00
db:	JVNDB	id:	JVNDB-2019-004044	date:	2019-05-27T00:00:00
db:	CNNVD	id:	CNNVD-201904-1396	date:	2019-05-08T00:00:00
db:	NVD	id:	CVE-2019-3938	date:	2024-11-21T04:42:54.287

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-155373	date:	2019-04-30T00:00:00
db:	JVNDB	id:	JVNDB-2019-004044	date:	2019-05-27T00:00:00
db:	CNNVD	id:	CNNVD-201904-1396	date:	2019-04-30T00:00:00
db:	NVD	id:	CVE-2019-3938	date:	2019-04-30T21:29:01.260