CVE-2019-3929

🗓️ 30 Apr 2019 20:21:09Reported by tenableType

cve🔗 web.nvd.nist.gov👁 1074 Views🌐 WEB

Command injection vulnerability in multiple wireless presentation system

Reporter	Title	Published	Views	Family All 24
0day.today	Barco / AWIND OEM Presentation Platform Unauthenticated Remote Command Injection Vulnerability	3 May 201900:00	–	zdt
0day.today	Barco WePresent - file_transfer.cgi Command Injection Exploit	15 Jan 202000:00	–	zdt
GithubExploit	Exploit for Cross-site Scripting in Crestron Am-100_Firmware	17 Sep 201916:23	–	githubexploit
ATTACKERKB	CVE-2019-3929	30 Apr 201900:00	–	attackerkb
Tenable Nessus	WePresent file_transfer.cgi Remote Command Execution	30 Apr 201900:00	–	nessus
Circl	CVE-2019-3929	17 Dec 201914:15	–	circl
CISA KEV Catalog	Crestron Multiple Products Command Injection Vulnerability	15 Apr 202200:00	–	cisa_kev
Check Point Advisories	Barco EOM Presentation platform Remote Code Execution (CVE-2019-3929)	12 May 201900:00	–	checkpoint_advisories
Cvelist	CVE-2019-3929	30 Apr 201920:21	–	cvelist
Exploit DB	Crestron AM/Barco wePresent WiPG/Extron ShareLink/Teq AV IT/SHARP PN-L703WA/Optoma WPS-Pro/Blackbox HD WPS/InFocus LiteShow - Remote Command Injection	3 May 201900:00	–	exploitdb

NVD

Node

crestron am-100_firmwareMatch1.6.0.2

AND

crestron am-100Match-

Node

crestron am-101_firmwareMatch2.7.0.2

AND

crestron am-101Match-

Node

barco wepresent_wipg-1000p_firmwareMatch2.3.0.10

AND

barco wepresent_wipg-1000pMatch-

Node

barco wepresent_wipg-1600w_firmwareRange<2.4.1.19

AND

barco wepresent_wipg-1600wMatch-

Node

extron sharelink_200_firmwareMatch2.0.3.4

AND

extron sharelink_200Match-

Node

extron sharelink_250_firmwareMatch2.0.3.4

AND

extron sharelink_250Match-

Node

teqavit wips710_firmwareMatch1.1.0.7

AND

teqavit wips710Match-

Node

sharp pn-l703wa_firmwareMatch1.4.2.3

AND

sharp pn-l703waMatch-

Node

optoma wps-pro_firmwareMatch1.0.0.5

AND

optoma wps-proMatch-

Node

blackbox hd_wireless_presentation_system_firmwareMatch1.0.0.5

AND

blackbox hd_wireless_presentation_systemMatch-

Node

infocus liteshow3_firmwareMatch1.0.16

AND

infocus liteshow3Match-

Node

infocus liteshow4_firmwareMatch2.0.0.7

AND

infocus liteshow4Match-

[
  {
    "product": "Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4.",
    "vendor": "Crestron",
    "versions": [
      {
        "status": "affected",
        "version": "Crestron AM-100 firmware 1.6.0.2"
      },
      {
        "status": "affected",
        "version": "Crestron AM-101 firmware 2.7.0.1"
      },
      {
        "status": "affected",
        "version": "Barco wePresent WiPG-1000P firmware 2.3.0.10"
      },
      {
        "status": "affected",
        "version": "Barco wePresent WiPG-1600W before firmware 2.4.1.19"
      },
      {
        "status": "affected",
        "version": "Extron ShareLink 200/250 firmware 2.0.3.4"
      },
      {
        "status": "affected",
        "version": "Teq AV IT WIPS710 firmware 1.1.0.7"
      },
      {
        "status": "affected",
        "version": "SHARP PN-L703WA firmware 1.4.2.3"
      },
      {
        "status": "affected",
        "version": "Optoma WPS-Pro firmware 1.0.0.5"
      },
      {
        "status": "affected",
        "version": "Blackbox HD WPS firmware 1.0.0.5"
      },
      {
        "status": "affected",
        "version": "InFocus LiteShow3 firmware 1.0.16"
      },
      {
        "status": "affected",
        "version": "and InFocus LiteShow4 2.0.0.7"
      }
    ]
  }
]

Source	Link
exploit-db	www.exploit-db.com/exploits/46786/
packetstormsecurity	www.packetstormsecurity.com/files/155948/Barco-WePresent-file_transfer.cgi-Command-Injection.html
packetstormsecurity	www.packetstormsecurity.com/files/152715/Barco-AWIND-OEM-Presentation-Platform-Unauthenticated-Remote-Command-Injection.html
tenable	www.tenable.com/security/research/tra-2019-20
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
file_transfer	request body	/cgi-bin/file_transfer.cgi	Unauthenticated remote command injection via crafted POST to file_transfer.cgi.	CWE-78, CWE-79
dir	request body	/cgi-bin/file_transfer.cgi	Unauthenticated remote command injection via crafted POST to file_transfer.cgi.	CWE-78, CWE-79

03 Nov 2025 18:59Current

9.8High risk

Vulners AI Score9.8

CVSS 3.19.8

CVSS 210

EPSS0.94253

SSVC

cve-2019-3929 information security vulnerability command injection remote attack wireless presentation systems firmware operating system commands cve