CVE-2019-3929

2019-04-3020:21:09

CWE-79

tenable

www.cve.org

10 High

AI Score

Confidence

High

0.974 High

EPSS

Percentile

99.9%

JSON

The Crestron AM-100 firmware 1.6.0.2, Crestron AM-101 firmware 2.7.0.1, Barco wePresent WiPG-1000P firmware 2.3.0.10, Barco wePresent WiPG-1600W before firmware 2.4.1.19, Extron ShareLink 200/250 firmware 2.0.3.4, Teq AV IT WIPS710 firmware 1.1.0.7, SHARP PN-L703WA firmware 1.4.2.3, Optoma WPS-Pro firmware 1.0.0.5, Blackbox HD WPS firmware 1.0.0.5, InFocus LiteShow3 firmware 1.0.16, and InFocus LiteShow4 2.0.0.7 are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote, unauthenticated attacker can use this vulnerability to execute operating system commands as root.

CNA Affected

[
  {
    "product": "Crestron AirMedia, Barco WePresent, Extron ShareLink, Teq AV IT WIPS710, SHARP PN-L703WA, Optoma WPS-Pro, Blackbox HD WPS, InFocus LiteShow3, and InFocus LiteShow4.",
    "vendor": "Crestron",
    "versions": [
      {
        "status": "affected",
        "version": "Crestron AM-100 firmware 1.6.0.2"
      },
      {
        "status": "affected",
        "version": "Crestron AM-101 firmware 2.7.0.1"
      },
      {
        "status": "affected",
        "version": "Barco wePresent WiPG-1000P firmware 2.3.0.10"
      },
      {
        "status": "affected",
        "version": "Barco wePresent WiPG-1600W before firmware 2.4.1.19"
      },
      {
        "status": "affected",
        "version": "Extron ShareLink 200/250 firmware 2.0.3.4"
      },
      {
        "status": "affected",
        "version": "Teq AV IT WIPS710 firmware 1.1.0.7"
      },
      {
        "status": "affected",
        "version": "SHARP PN-L703WA firmware 1.4.2.3"
      },
      {
        "status": "affected",
        "version": "Optoma WPS-Pro firmware 1.0.0.5"
      },
      {
        "status": "affected",
        "version": "Blackbox HD WPS firmware 1.0.0.5"
      },
      {
        "status": "affected",
        "version": "InFocus LiteShow3 firmware 1.0.16"
      },
      {
        "status": "affected",
        "version": "and InFocus LiteShow4 2.0.0.7"
      }
    ]
  }
]