Description
webctrl.cgi.elf on Christie Digital DWU850-GS V06.46 devices allows attackers to perform any desired action via a crafted query containing an unspecified Cookie header. Authentication bypass can be achieved by including an administrative cookie that the device does not validate.
References (1)
Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://securityshards.wordpress.com/2021/08/31/cve-pending-christie-dwu850-gs-authentication-bypass/
Scores
CVSS v3
9.8
EPSS
0.0155
EPSS Percentile
72.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-287
Status
published
Products (1)
christiedigital/dwu850-gs_firmware
06.46
Published
Sep 01, 2021
Tracked Since
Feb 18, 2026