EUVD-2017-18934CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionNVD
Serviio PRO 1.8 contains an improper access control vulnerability in the Configuration REST API that allows unauthenticated attackers to change the mediabrowser login password. Attackers can send specially crafted requests to the REST API endpoints to modify credentials without authentication.
AnalysisAI
An improper access control vulnerability in Serviio PRO 1.8's Configuration REST API allows unauthenticated remote attackers to change the mediabrowser login password without any authentication. Multiple public proof-of-concept exploits are available on Exploit-DB and PacketStorm, making this vulnerability trivially exploitable. The vulnerability affects Serviio PRO versions 1.6.1 through 1.8.0.0 PRO and represents a complete authentication bypass allowing full account takeover.
Technical ContextAI
Serviio PRO is a media server software that exposes a REST API for configuration management. The vulnerability stems from CWE-306 (Missing Authentication for Critical Function), where the password change endpoint in the Configuration REST API fails to verify if the request comes from an authenticated user. The CPE identifier cpe:2.3:a:serviio:serviio_pro:*:*:*:*:*:*:*:* indicates all versions are potentially affected, though EUVD specifically confirms versions 1.6.1, 1.7.0, 1.7.1, and 1.8.0.0 PRO. The REST API endpoint accepts specially crafted HTTP requests to modify user credentials without requiring any form of authentication token or session validation.
RemediationAI
No specific patch version or vendor advisory is mentioned in the provided references. Users should upgrade to a version newer than 1.8.0.0 PRO if available. As immediate mitigation, administrators should: 1) Restrict network access to the Serviio REST API using firewall rules, 2) Place the API behind authentication proxy or VPN, 3) Monitor for unauthorized password change attempts in logs. Contact Serviio support for official patch information as no vendor advisory link is present in the references. The Zero Science Labs advisory (ZSL-2017-5407) may contain additional remediation details.
Share
External POC / Exploit Code
Leaving vuln.today