CVE-2017-15304
Critical
Description
/bin/login.php in the Web Panel on the Airtame HDMI dongle with firmware before 3.0 allows an attacker to set his own session id via a "Cookie: PHPSESSID=" header. This can be used to achieve persistent access to the admin panel even after an admin password change.
SeverityCritical
CVSS9.8
Exploit probability—
ProductAirtame Hdmi Dongle Firmware
PublishedOct 15, 2017
First seenOct 15, 2017
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| airtame hdmi_dongle_firmware | v ≤ 2.3.3 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.