Published: 21/09/2017 Updated: 29/09/2017

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 660

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

Arbitrary File Upload in resource.php of TecnoVISION DLX Spot Player4 version >1.5.10 allows remote authenticated users to upload arbitrary files leading to Remote Command Execution.

Vulnerable Product	Search on Vulmon	Subscribe to Product
tecnovision dlx spot player4 -

# Exploit Title: DlxSpot - Player4 LED video wall - Arbitrary File Upload to RCE # Google Dork: "DlxSpot - Player4" # Date: 2017-05-14 # Discoverer: Simon Brannstrom # Authors Website: unknownpwngithubio/ # Vendor Homepage: wwwtecnovisioncom/ # Software Link: n/a # Version: >1510 # Tested on: Linux # About: DlxSpot is the so ...

# Exploit Title: DlxSpot - Player4 LED video wall - Hardcoded Root SSH Password # Google Dork: "DlxSpot - Player4" # Date: 2017-05-14 # Discoverer: Simon Brannstrom # Authors Website: unknownpwngithubio/ # Vendor Homepage: wwwtecnovisioncom/ # Software Link: n/a # Version: All known versions # Tested on: Linux # About: DlxSpot i ...

DlxSpot Player4 LED video wall has a hardcoded password that allows you to ssh in and escalate to root ...

DlxSpot Player4 LED video wall suffers from a remote shell upload vulnerability Versions greater than 1510 are affected ...

DlxSpot Player4 LED video wall suffers from a remote SQL injection vulnerability that allows for authentication bypass Versions greater than 1510 are affected ...

infosec enthusiast and madman

Tecnovision LED Video Wall Vulnerabilities and Exploits From SQLi to full root access Introduction: Tecnovision is a manufacturer of LED Video Walls used in arenas (For example, Twickenham Stadium), concert halls, shopping malls, as roadsigns and much much more DlxSpot Player 4 is the software controller for some of these LED walls These are the unpatched exploits that I ha

CWE-434 http://packetstormsecurity.com/files/144258/DlxSpot-Shell-Upload.html https://nvd.nist.gov https://github.com/unknownpwn/unknownpwn.github.io https://www.exploit-db.com/exploits/42755/

CVE-2017-12929

Vulnerability Summary

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect