CVE-2018-13860 MusicCenter / Trivum Multiroom Setup Tool V8.76 - SNR 8604.26 - C4 Professional before V9.34 build 13381 - 12.07.18 allows unauthorized remote attackers to obtain sensitive information via the "/xml/m...
HighCVSS 7.5
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
MusicCenter / Trivum Multiroom Setup Tool V8.76 - SNR 8604.26 - C4 Professional before V9.34 build 13381 - 12.07.18 allows unauthorized remote attackers to obtain sensitive information via the "/xml/menu/getObjectEditor.xml" URL, using a "?oid=systemSetup&id=_0" or "?oid=systemUsers&id=_0" GET request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| trivum c4 professional firmware | = 8.76 | No fix listed |
References
- update.trivum.com vendor-advisory
- vulncode.com third-party-advisory