goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) on a device, as demonstrated by a setString=new_user<*1*>administrator<*1*>123456 request.
Affected vendor
sumavisionAffected product
enhanced multimedia router firmwareCoverage
Single affected product entry
CVSS
9.8
CRITICAL
Published
Mar 11, 2020