CVE-2018-13859 — CRITICAL (9.8)

Vulnerability Description

MusicCenter / Trivum Multiroom Setup Tool V8.76 - SNR 8604.26 - C4 Professional before V9.34 build 13381 - 12.07.18, allow unauthorized remote attackers to reset the authentication via the "/xml/system/setAttribute.xml" URL, using the GET request "?id=0&attr=protectAccess&newValue=0" (a successful attack will allow attackers to login without authorization).

CVSS Score

9.8

CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Trivum	C4 Professional Firmware	8.76
Trivum	C4 Professional	-

References

http://update.trivum.com/update/v9-changes.htmlVendor Advisory
https://vulncode.com/advisory/CVE-2018-13859Third Party Advisory
https://www.exploit-db.com/exploits/45088/ExploitThird Party AdvisoryVDB Entry
http://update.trivum.com/update/v9-changes.htmlVendor Advisory
https://vulncode.com/advisory/CVE-2018-13859Third Party Advisory
https://www.exploit-db.com/exploits/45088/ExploitThird Party AdvisoryVDB Entry

FAQ

What is CVE-2018-13859?

CVE-2018-13859 is a vulnerability with a CVSS score of 9.8 (CRITICAL). MusicCenter / Trivum Multiroom Setup Tool V8.76 - SNR 8604.26 - C4 Professional before V9.34 build 13381 - 12.07.18, allow unauthorized remote attackers to reset the authentication via the "/xml/syste...

How severe is CVE-2018-13859?

CVE-2018-13859 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2018-13859?

Check the references section above for vendor advisories and patch information. Affected products include: Trivum C4 Professional Firmware, Trivum C4 Professional.