Vulnerabilities

TI-2017-09576 CVE-2017-12930 · GHSA-f773-ghcg-hwm9

SQL Injection in the admin interface in TecnoVISION DLX Spot Player4 version >1.5.10…

MEDIUM 48

SQL Injection in the admin interface in TecnoVISION DLX Spot Player4 version >1.5.10 allows remote unauthenticated users to access the web interface as administrator via a crafted password.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03105 Published 2017-09-21 No fix listed CWE-89

TI-2017-09575 CVE-2017-12929 · GHSA-vgw9-x3rx-wxwm

Arbitrary File Upload in resource.php of TecnoVISION DLX Spot Player4 version >1.5.10…

MEDIUM 50

Arbitrary File Upload in resource.php of TecnoVISION DLX Spot Player4 version >1.5.10 allows remote authenticated users to upload arbitrary files leading to Remote Command Execution.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.10081 Published 2017-09-21 No fix listed CWE-434

TI-2017-09574 CVE-2017-12928 · GHSA-595g-28jh-rfh7

A hard-coded password of tecn0visi0n for the dlxuser account in TecnoVISION DLX Spot…

MEDIUM 47

A hard-coded password of tecn0visi0n for the dlxuser account in TecnoVISION DLX Spot Player4 (all known versions) allows remote attackers to log in via SSH and escalate privileges to root access with the same credentials…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02948 Published 2017-09-21 No fix listed CWE-798

Vulnerabilities

Filters

SQL Injection in the admin interface in TecnoVISION DLX Spot Player4 version >1.5.10…

Arbitrary File Upload in resource.php of TecnoVISION DLX Spot Player4 version >1.5.10…

A hard-coded password of tecn0visi0n for the dlxuser account in TecnoVISION DLX Spot…