CVE-2022-23178

What it actually does

The administrative web interface on Crestron HD-MD4X2-4K-E firmware 1.0.0.2159 exposes valid web credentials to unauthenticated network clients. A request to the aj.html endpoint returns a JSON document containing uname and upassword fields, allowing an attacker with network access to recover administrative credentials and authenticate normally. Because the disclosed credentials are valid for the management interface, the flaw effectively becomes an authentication bypass with full confidentiality, integrity, and availability impact for the device configuration and management plane.

Why it matters to the business

An attacker who can reach the device management interface can take over the HDMI switcher without prior credentials, change AV routing or device settings, disrupt meeting rooms or production AV workflows, and potentially use the device as a foothold into poorly segmented control networks. The issue has a critical CVSS score, high EPSS likelihood, and weaponized exploitation maturity, so internet-exposed or broadly reachable devices should be treated as high-priority even though it is not currently listed in CISA KEV. The provided affected-product metadata referencing vim/vim appears inconsistent with the vulnerability description and should not be used as the basis for remediation decisions for this Crestron device issue.

How an attack unfolds

An attacker first identifies a reachable Crestron HD-MD4X2-4K-E administrative web interface, typically through network scanning, asset discovery, or exposed HTTP/HTTPS services. Without logging in, the attacker requests the aj.html resource from the web interface. On vulnerable firmware, the device responds with JSON containing uname and upassword values. The attacker then uses those disclosed credentials to log in to the administrative interface as a legitimate user. Once authenticated, the attacker can review or modify device configuration, change signal routing, disrupt AV operations, persist by changing credentials where supported, and potentially pivot further if the AV management network has access to other internal services.

How to fix it

Upgrade affected Crestron HD-MD4X2-4K-E devices running firmware 1.0.0.2159 to a vendor-provided firmware version that removes unauthenticated credential disclosure. If an immediate firmware update is not available, restrict access to the administrative interface to trusted management networks only, block internet exposure, enforce firewall or ACL controls, and place AV/control devices behind VPN or jump-host access. Rotate any credentials exposed by the vulnerable endpoint after upgrading or otherwise mitigating access. Review device configuration for unauthorized changes. The listed fixed version 'vim/vim (GIT): fixed in 409510c588b1eec1ae33511ae97a21eb8e110895' does not align with the described Crestron vulnerability and should not be considered a valid fix for the affected Crestron hardware.

How to confirm the fix worked

Confirm exposure by identifying Crestron HD-MD4X2-4K-E devices and verifying firmware versions. A vulnerable device will allow an unauthenticated HTTP/HTTPS request to /aj.html and return JSON containing sensitive fields such as uname and upassword. A fixed or adequately mitigated device should deny unauthenticated access with 401/403, redirect to a login flow without disclosing credentials, or omit credential values entirely. Validate that management ports are not reachable from untrusted networks or the public internet. After remediation, retest the endpoint, confirm firmware is no longer 1.0.0.2159, and verify that administrative credentials have been rotated.

Typical attack path

1. Discover a reachable Crestron HD-MD4X2-4K-E web management interface over HTTP or HTTPS.
2. Send an unauthenticated request for /aj.html.
3. Parse the JSON response for uname and upassword fields.
4. Authenticate to the administrative web interface using the disclosed credentials.
5. Modify device settings, disrupt HDMI routing, harvest configuration details, or change access settings.
6. Use the compromised device or exposed management network as a staging point for additional reconnaissance if network segmentation is weak.

How to detect it

Look for evidence that the administrative web interface was accessed without authentication and that the credential-disclosure endpoint was requested. Relevant sources include device web server logs if available, reverse proxy logs, firewall logs, NetFlow, Zeek HTTP logs, packet captures, EDR/network sensor telemetry, and authentication logs from the device management interface. Search for GET or POST requests to /aj.html, especially from unfamiliar IP addresses, scanners, VPN exits, cloud hosting ranges, or hosts that subsequently log in successfully to the web interface. If packet captures or full HTTP response logging exist, look for responses containing JSON fields named uname and upassword. Investigate sequences where an unauthenticated /aj.html request is followed by administrative page access, configuration changes, credential changes, firmware operations, or unusual device reboots. Because exploitation may leave only normal-looking authenticated activity after credential disclosure, correlate endpoint requests with any later administrative actions from the same source IP or user agent.

• GET /aj.html
• POST /aj.html
• /aj.html
• "uname"
• "upassword"
• uname=
• upassword=
• HTTP/1.1" 200
• Crestron HD-MD4X2-4K-E
• curl/
• python-requests
• Go-http-client
• Wget/

What your security team should do

• Immediately inventory Crestron HD-MD4X2-4K-E devices and determine whether firmware 1.0.0.2159 is present.
• Prioritize remediation for devices reachable from the internet, guest networks, conference networks, or any non-dedicated management segment.
• Upgrade affected devices using Crestron-supported firmware or compensating controls if a firmware update cannot be applied immediately.
• Block unauthenticated access to the administrative interface from untrusted networks using firewalls, ACLs, VPN, or management VLAN isolation.
• Rotate device administrative credentials after patching or isolating the device because credentials may already have been exposed.
• Review web access logs, proxy logs, firewall logs, and packet captures for unauthenticated requests to /aj.html and follow-on administrative logins.
• Inspect device configuration for unauthorized changes to routing, network settings, users, passwords, or remote management options.
• Do not rely on the provided vim/vim fixed commit as remediation for this Crestron device vulnerability; verify against Crestron firmware guidance.