Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Crestron AM-100/AM-101 lets anyone view slideshow without code

CVE-2019-3933 · published 7 years ago
Summary

The AM-100 firmware 1.6.0.2 and AM-101 firmware 2.7.0.2 allow anyone on the network to see the presentation by simply requesting a specific image file. This means an outsider could watch the displayed slides without knowing the required access code. Update the device firmware or block the HTTP request to stop the bypass.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
crestron am-100_firmware 1.6.0.2
cpe:2.3:o:crestron:am-100_firmware:1.6.0.2:*:*:*:*:*:*:*
crestron am-101_firmware 2.7.0.2
cpe:2.3:o:crestron:am-101_firmware:2.7.0.2:*:*:*:*:*:*:*
Original advisory text
Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass the presentation code simply by requesting /images/browserslide.jpg via HTTP. A remote, unauthenticate...
Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass the presentation code simply by requesting /images/browserslide.jpg via HTTP. A remote, unauthenticated attacker can use this vulnerability to watch a slideshow without knowing the access code.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.3 Medium
Exploitation
6% chance of attack within 30 days
Type
CWE-284Improper Access Control
CWE-425Direct Request ('Forced Browsing')
Timeline
Published30 Apr 2019
Updated22 Oct 2026
First seen29 Sep 2026
Sources
CVE-2019-3933 · NVD
Track software like this
Free during beta