ReQuest Serious Play F3 Media Server Remote Denial-of-Service Vulnerability

A remote denial-of-service vulnerability has been identified in ReQuest Serious Play F3 Media Server versions 7.0.3.4968 (Pro), 7.0.2.4954, 6.5.2.4954, 6.4.2.4681, 6.3.2.4203, and 2.0.1.823. This vulnerability allows an unauthenticated attacker to shut down or reboot the device by sending a single crafted HTTP GET request, thereby interrupting service availability.

Impact

Exploitation of this vulnerability leads to a remote denial-of-service condition, causing the media server to shut down or reboot.

Reproduction

The vulnerability can be reproduced by sending an HTTP GET request to the '/remote/index.php' endpoint with the 'cmd' parameter set to 'poweroff' or 'reboot'. This can be done using a tool like cURL.