CVE-2017-12929

HIGH

TecnoVISION DLX Spot Player4 >1.5.10 - Authenticated Arbitrary File Upload via resource.php

Title source: llm

Exploitation Summary

EIP tracks 2 public exploits for CVE-2017-12929. PoCs published by Simon Brannstrom.

AI-analyzed exploit summary This exploit demonstrates an arbitrary file upload vulnerability in DlxSpot - Player4 LED video wall software, leading to remote command execution (RCE). The attacker uploads a malicious PHP shell via `resource.php` and executes commands through a crafted HTTP request.

Description

Arbitrary File Upload in resource.php of TecnoVISION DLX Spot Player4 version >1.5.10 allows remote authenticated users to upload arbitrary files leading to Remote Command Execution.

Exploits (2)

exploitdb WORKING POC

by Simon Brannstrom · textwebappsphp

https://www.exploit-db.com/exploits/42755

View Code ZIP pw:eip

This exploit demonstrates an arbitrary file upload vulnerability in DlxSpot - Player4 LED video wall software, leading to remote command execution (RCE). The attacker uploads a malicious PHP shell via `resource.php` and executes commands through a crafted HTTP request.

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: DlxSpot - Player4 LED video wall >1.5.10

No auth needed

Prerequisites: Network access to the target web interface · PHP execution enabled on the server

MITRE ATT&CK

T1105 - Ingress Tool Transfer T1203 - Exploitation for Client Execution

devstral-2 · analyzed Feb 18, 2026 Full analysis →

exploitdb WRITEUP

remotemultiple

https://www.exploit-db.com/exploits/42753

View Code ZIP pw:eip

This is a technical writeup detailing hardcoded SSH credentials (dlxuser:tecn0visi0n) in DlxSpot Player4 LED video wall software, allowing authentication bypass and privilege escalation to root. The vulnerability is confirmed in all known versions, with no patch available.

Classification

Writeup 100%

Attack Type

Auth Bypass

Complexity

Trivial

Reliability

Reliable

Target: DlxSpot Player4 LED video wall software (all versions)

No auth needed

Prerequisites: network access to the target device · SSH service exposed

MITRE ATT&CK

T1078 - Valid Accounts T1068 - Exploitation for Privilege Escalation

devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (1)

Core 1

Core References

Exploit, Third Party Advisory, VDB Entry x_refsource_misc

http://packetstormsecurity.com/files/144258/DlxSpot-Shell-Upload.html

Scores

CVSS v3 8.8

EPSS 0.1008

EPSS Percentile 95.0%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-434

Status published

Products (1)

tecnovision/dlx_spot_player4

Published Sep 21, 2017

Tracked Since Feb 18, 2026