CVE-2022-23178: Crestron HDMI switcher web interface leaks admin credentials unauthenticated

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable disclosure of valid administrative credentials with a CVSS score of 9.8 and very high EPSS probability.

What it is

The Crestron HD-MD4X2-4K-E HDMI switcher exposes administrative credentials through its web interface without requiring authentication. The aj.html endpoint returns a JSON document containing uname and upassword fields, so anyone who can reach the device can obtain valid login credentials. This matters because the leaked credentials grant full control of the device's administrative interface.

Impact

An attacker gains working administrative credentials for the web interface, allowing configuration changes and control of the HDMI switcher. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reachable over the network via the device's administrative web interface; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The aj.html endpoint returns the credential JSON to any requester.

Exploitation

Not listed in CISA KEV, but EPSS is 0.75159 (99.485th percentile), indicating a high predicted likelihood of exploitation activity. Both references are tagged Exploit and Third Party Advisory, so public exploit detail exists.

What to do

• Apply the vendor firmware update for the HD-MD4X2-4K-E; the record does not state a fixed version, so confirm with Crestron.
• Restrict network access to the device web interface to trusted management networks only.
• Change any credentials exposed by the device and audit for prior unauthorized logins.
• If the device cannot be patched or isolated, disable or block the administrative web interface.
• Monitor vendor advisories for updated remediation guidance.

Detection

• Search web/proxy logs for requests to aj.html on Crestron device IPs.
• Alert on unauthenticated access to the device administrative interface from unexpected sources.
• Review device authentication logs for logins using the leaked credentials or from unusual hosts.
• Inventory internet- or broadly reachable Crestron HDMI switchers on the network.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.