CVE-2023-6926

2024-01-2320:15:45

CWE-78

[email protected]

web.nvd.nist.gov

vulnerability

command injection

crestron am-300

firmware

escalation

ssh

privilege

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

9.5%

JSON

There is an OS command injection vulnerability in Crestron AM-300 firmware version 1.4499.00018 which may enable a user of a limited-access SSH session to escalate their privileges to root-level access.

Affected configurations

Nvd

Node

crestronam-300Match-

AND

crestronam-300_firmwareMatch1.4499.00018

VendorProductVersionCPE
crestronam-300-cpe:2.3:h:crestron:am-300:-:*:*:*:*:*:*:*
crestronam-300_firmware1.4499.00018cpe:2.3:o:crestron:am-300_firmware:1.4499.00018:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
crestron	am-300	-	cpe:2.3:h:crestron:am-300:-:::::::*
crestron	am-300_firmware	1.4499.00018	cpe:2.3:o:crestron:am-300_firmware:1.4499.00018:::::::*