Threats tagged 'ghsa-6jxq-hx4m-w98p'

Axel Technology StreamerMAX MK II devices with firmware versions 0.8.5 to 1.0.3 have a critical Broken Access Control vulnerability. The flaw is due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint, allowing unauthenticated remote attackers to fully compromise the device by listing user accounts, creating administrative users, deleting users, and modifying system settings.