CVE-2018-13858 — CRITICAL (9.8)

Vulnerability Description

MusicCenter / Trivum Multiroom Setup Tool V8.76 - SNR 8604.26 - C4 Professional allows unauthorized remote attackers to reboot or execute other functions via the "/xml/system/control.xml" URL, using the GET request "?action=reboot" for example.

CVSS Score

9.8

CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Trivum	C4 Professional Firmware	8.76
Trivum	C4 Professional	-

References

https://vulncode.com/advisory/CVE-2018-13858Third Party Advisory
https://vulncode.com/advisory/CVE-2018-13858Third Party Advisory

FAQ

What is CVE-2018-13858?

CVE-2018-13858 is a vulnerability with a CVSS score of 9.8 (CRITICAL). MusicCenter / Trivum Multiroom Setup Tool V8.76 - SNR 8604.26 - C4 Professional allows unauthorized remote attackers to reboot or execute other functions via the "/xml/system/control.xml" URL, using t...

How severe is CVE-2018-13858?

CVE-2018-13858 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2018-13858?

Check the references section above for vendor advisories and patch information. Affected products include: Trivum C4 Professional Firmware, Trivum C4 Professional.