Read the docs

Crestron

Records47All Threatist records
Exploited (KEV)1In CISA KEV
CVSS critical22CVSS 9.0–10.0
CVSS high17CVSS 7.0–8.9

Exploited now

Crestron records in CISA KEV
TI-2019-02935 Crestron Multiple Products Command Injection Vulnerability Priority CRITICAL 100KEV 2022-04-15

Components

Products in the NVD configurations · select one to filter the records
Am-100 Firmware 15 records CRITICAL Am-101 Firmware 15 records CRITICAL Dm-txrx-100-str Firmware 6 records MEDIUM Airmedia Am-100 Firmware 5 records HIGH Airmedia 4 records MEDIUM Airmedia Am-101 Firmware 2 records HIGH Crestron Toolbox Protocol Firmware 2 records MEDIUM Mc3 Firmware 2 records MEDIUM

Records

15 records in Am-100 Firmware · all components

TI-2019-02935 CVE-2019-3929 · GHSA-m297-v8rg-x5fh

Cross-site scripting in Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT…

Priority CRITICAL 100KEV

The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.98952 Published 2019-04-30 No fix listed CWE-79
TI-2019-02938 CVE-2019-3932 · GHSA-4jfp-525m-fpgx

Hard-coded credentials in Crestron AirMedia

Priority HIGH 68

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to authentication bypass due to a hard-coded password in return.tgi.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.36325 Published 2019-04-30 No fix listed CWE-249
TI-2019-02936 CVE-2019-3930 · GHSA-xp69-2936-4v92

Stack-based buffer overflow in Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq…

Priority MEDIUM 52

The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06957 Published 2019-04-30 No fix listed CWE-121
TI-2019-02932 CVE-2019-3926 · GHSA-7ww3-ff9f-f9q9

Cross-site scripting in Crestron AirMedia

Priority MEDIUM 52

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to command injection via SNMP OID iso.3.6.1.4.1.3212.100.3.2.14.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0685 Published 2019-04-30 No fix listed CWE-79
TI-2019-02931 CVE-2019-3925 · GHSA-242r-53mf-qx5c

Cross-site scripting in Crestron AirMedia

Priority MEDIUM 52

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to command injection via SNMP OID iso.3.6.1.4.1.3212.100.3.2.9.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0685 Published 2019-04-30 No fix listed CWE-79
TI-2019-02945 CVE-2019-3939 · GHSA-348m-h4rf-cr2v

Hard-coded credentials in Crestron AirMedia

Priority MEDIUM 47

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 use default credentials admin/admin and moderator/moderator for the web interface.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02764 Published 2019-04-30 No fix listed CWE-16
TI-2019-02933 CVE-2019-3927 · GHSA-8926-mj52-jxcv

Improper access control in Crestron AirMedia

Priority MEDIUM 46

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 anyone can change the administrator and moderator passwords via the iso.3.6.1.4.1.3212.100.3.2.8.1 and iso.3.6.1.4.1.3212.100.3.2.8.2 OIDs.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02167 Published 2019-04-30 No fix listed CWE-284
TI-2019-02941 CVE-2019-3935 · GHSA-6486-99c6-494w

Improper access control in Crestron AirMedia

Priority MEDIUM 45

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to act as a moderator to a slide show via crafted HTTP POST requests to conference.cgi.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.03334 Published 2019-04-30 No fix listed CWE-284
TI-2019-02942 CVE-2019-3936 · GHSA-vm5p-w959-c36r

Improper access control in Crestron AirMedia

Priority LOW 37

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 is vulnerable to denial of service via a crafted request to TCP port 389.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02143 Published 2019-04-30 No fix listed CWE-284
TI-2019-02940 CVE-2019-3934 · GHSA-gqcf-3mp9-v4ch

Improper access control in Crestron AirMedia

Priority LOW 35

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass the presentation code sending a crafted HTTP POST request to login.cgi.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.07727 Published 2019-04-30 No fix listed CWE-284
TI-2019-02944 CVE-2019-3938 · GHSA-fgmr-rpcg-m7f6

Insufficiently protected credentials in Crestron AirMedia

Priority LOW 34

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 stores usernames, passwords, and other configuration options in the file generated via the "export configuration" feature.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00259 Published 2019-04-30 No fix listed CWE-522
TI-2019-02943 CVE-2019-3937 · GHSA-8x72-xc5h-ww5p

Cleartext storage of sensitive information in Crestron AirMedia

Priority LOW 34

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 stores usernames, passwords, slideshow passcode, and other configuration options in cleartext in the file /tmp/scfgdndf.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00282 Published 2019-04-30 No fix listed CWE-312
TI-2019-02939 CVE-2019-3933 · GHSA-gvhj-249r-67hf

Improper access control in Crestron AirMedia

Priority LOW 33

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allows anyone to bypass the presentation code simply by requesting /images/browserslide.jpg via HTTP.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0595 Published 2019-04-30 No fix listed CWE-284
TI-2019-02934 CVE-2019-3928 · GHSA-mpv7-gcx8-hrh4

Improper access control in Crestron AirMedia

Priority LOW 28

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 allow any user to obtain the presentation passcode via the iso.3.6.1.4.1.3212.100.3.2.7.4 OIDs.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01769 Published 2019-04-30 No fix listed CWE-284
Open these records in search →