Login Request a demo
High severity · published Jul 30, 2021
CVE-2020-16839
On Crestron DM-NVX-DIR, DM-NVX-DIR80, and DM-NVX-ENT devices before the DM-XIO/1-0-3-802 patch, the password can be changed by sending an unauthenticated WebSocket request
7.5
CVSS
1.2%
EPSS
No
On KEV
Description
On Crestron DM-NVX-DIR, DM-NVX-DIR80, and DM-NVX-ENT devices before the DM-XIO/1-0-3-802 patch, the password can be changed by sending an unauthenticated WebSocket request.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
Dm-nvx-dir-160 Firmware · Crestron
1.0.1.788 · source: NVD
DF
Dm-nvx-dir-80 Firmware · Crestron
1.0.1.788 · source: NVD
DF
Dm-nvx-dir-ent Firmware · Crestron
1.0.1.788 · source: NVD
Affected product
DF
Dm-nvx-dir-160 Firmware
Crestron
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-16839
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-16839
Vendor Advisory
https://support.crestron.com
Permissions Required
https://www.crestron.com/Software-Firmware/Firmware/DigitalMedia/DM-XIO/1-0-3-802
Broken Link
https://www.security.crestron.com
Vendor Advisory
https://www.crestron.com/Security/Security-at-Crestron